The vulnerability is a PHP Local File Inclusion flaw in the BoldGrid Client Invoicing by Sprout Invoices plugin (versions through 20.8.9). The plugin improperly controls the filename supplied to include/require statements, allowing an attacker to force the application to include arbitrary local files. If the attacker can cause the script to execute code from a local file they control, it can lead to Remote Code Execution. This weakness is identified as CWE-98.

Affected systems are sites running the BoldGrid Client Invoicing by Sprout Invoices WordPress plugin from the initial release through version 20.8.9. No specific product subversions are listed, so all installations of those versions are considered vulnerable.

The CVSS score of 7.2 indicates high severity. EPSS score is below 1%, suggesting a low probability of current widespread exploitation, and it is not listed in CISA’s KEV catalog. The attack vector is likely a crafted HTTP request to a plugin endpoint that uses the unvalidated file parameter. Because it is a local file inclusion, the attacker must have access to the web application’s file system, which can be achieved through the exposed vulnerable feature.