This vulnerability in BoldGrid's Client Invoicing by Sprout Invoices plugin arises from missing authorization checks, which means that certain actions or resources may be accessible without proper permission validation. The issue affects versions up to 20.8.8. The CVSS 3.1 base score is 5.3 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity. No patch or vendor advisory is currently available to confirm remediation status.

The vulnerability allows unauthorized users to perform actions that should require authorization, potentially leading to unauthorized modifications (integrity impact) within the invoicing system. There is no impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to invoicing functions. Avoid exposing the plugin to untrusted users or networks.