The vulnerability is a missing authorization flaw that allows users to reach invoice endpoints without proper permission checks. An attacker with access to the WordPress site can request URLs that expose client invoices, potentially revealing personal, payment, or tax information. The weakness is classified as CWE‑862, indicating that requests bypass the intended access control controls.

BoldGrid Client Invoicing by Sprout Invoices is affected in version 20.8.1 and earlier. The plugin is used to generate and manage invoices within a WordPress installation, allowing users to create, view and download financial documents.

The CVSS score of 6.4 indicates moderate severity. The EPSS score of < 1 % shows a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers exploit the lack of authorization controls by performing HTTP requests to protected invoice endpoints; no special privileges or additional network exposure are required. If the site is publicly reachable and visitors can access these endpoints, the risk can impact any authenticated or even unauthenticated user.