This vulnerability in BoldGrid Client Invoicing by Sprout Invoices arises from improper validation of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) flaw. The issue affects all versions up to 20.8.9. The CVSS 3.1 base score is 7.2, indicating high severity, with network attack vector, low attack complexity, requiring high privileges, no user interaction, and impacts confidentiality, integrity, and availability. No patch or official remediation information is currently available.

Successful exploitation could allow an attacker with high privileges to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and limit privileges to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.