The vulnerability is a PHP Object Injection flaw caused by deserializing untrusted data in the BoldGrid Client Invoicing by Sprout Invoices plugin. An attacker may supply crafted serialized payloads that result in arbitrary PHP object instantiation, potentially allowing arbitrary PHP code execution. Such control over code execution undermines confidentiality, integrity, and availability of the affected WordPress site.

The affected product is the BoldGrid Client Invoicing by Sprout Invoices plugin, version 20.8.7 and earlier. Any WordPress installation using this plugin within that version range is vulnerable.

With a CVSS score of 9.8, the vulnerability is classified as Critical. The EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via a remote HTTP request that delivers a crafted serialized string; based on the description, it is inferred that authentication is not strictly required, making the vulnerability potentially exploitable by unauthenticated users.