This vulnerability involves deserialization of untrusted data in the BoldGrid Client Invoicing by Sprout Invoices plugin (versions <= 20.8.7). An attacker can exploit this flaw to perform object injection, which may lead to remote code execution or other severe impacts on the affected system. The vulnerability has a CVSS v3.1 base score of 9.8, reflecting its critical nature with network attack vector, no required privileges or user interaction, and full impact on confidentiality, integrity, and availability. No patch or mitigation details have been disclosed yet.

Successful exploitation could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, leading to complete compromise of the application and potentially the underlying server. The vulnerability impacts confidentiality, integrity, and availability at the highest level. No known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for suspicious activity related to object injection attempts. Avoid using affected versions in exposed environments.