CVE-2026-25364: 
WordPress vulnerability analysis and mitigation

CVE-2026-25364 is a Missing Authorization vulnerability in the BoldGrid "Client Invoicing by Sprout Invoices" WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. The vulnerability affects all versions of the plugin up to and including 20.8.8. It was published on February 19, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium), reflecting a network-accessible, low-complexity attack requiring no privileges or user interaction (Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before performing certain actions. This allows unauthenticated remote attackers to interact with functionality that should be restricted to authorized users, effectively exploiting incorrectly configured access control security levels. No user interaction is required, and the attack can be carried out over the network with low complexity (Feedly).

Successful exploitation of this vulnerability results in a limited integrity impact — an unauthenticated attacker may be able to perform unauthorized actions within the plugin's access-controlled functionality. There is no direct confidentiality or availability impact based on the CVSS scoring. The scope is limited to the affected WordPress plugin instance, with no evidence of lateral movement potential beyond the plugin's own data and operations (Feedly).

The vulnerability has a low EPSS score of approximately 0.017%, indicating a low probability of active exploitation in the near term. No public proof-of-concept exploit code, exploit kit integration, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and no user interaction, which lowers the barrier for exploitation if a PoC becomes available (Feedly).

Users of the "Client Invoicing by Sprout Invoices" WordPress plugin by BoldGrid should update to a version beyond 20.8.8 as soon as a patched release becomes available from the vendor. In the interim, site administrators should consider deactivating the plugin if it is not critical to operations, or restricting access to the WordPress site using firewall rules or web application firewall (WAF) policies. Monitoring plugin activity logs for unexpected or unauthorized actions may help detect exploitation attempts (Feedly).