The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Sprout Invoices Plugin | — | Update sprout-invoices plugin to version 20.8.16, or a newer patched version | Oct 30, 2026 | Sep 12, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub