CVE-2026-32401: 
WordPress vulnerability analysis and mitigation

CVE-2026-32401 is a Local File Inclusion (LFI) vulnerability in the BoldGrid "Client Invoicing by Sprout Invoices" WordPress plugin. It affects all versions up to and including 20.8.9, and was reported on January 22, 2026, with public disclosure on February 21, 2026 via Patchstack. The vulnerability carries a CVSS v3.1 base score of 7.2 (High), requiring high privileges (Author/Developer level) for exploitation (Patchstack).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion. The vulnerability arises from insufficient validation of user-supplied input used in PHP include/require statements within the plugin, allowing an attacker with Author or Developer-level WordPress privileges to manipulate file path parameters and force the server to include arbitrary local files. Exploitation occurs over the network with low attack complexity and requires no user interaction beyond the attacker's own authenticated session (Patchstack).

Successful exploitation allows an attacker to read arbitrary local files on the web server, including sensitive configuration files such as wp-config.php (which contains database credentials), potentially leading to complete database takeover. High confidentiality, integrity, and availability impacts are possible if credential files are exposed and leveraged for further access. The scope is limited to the affected system, but lateral movement within the hosting environment is feasible if database or system credentials are obtained (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.00138 (0.138%), indicating a low probability of exploitation in the near term. The vulnerability requires high privileges (Author/Developer role), which limits the attacker pool. Patchstack classifies this as low priority with no impactful threat currently observed, and it does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Client Invoicing by Sprout Invoices" plugin at version 20.8.9 or earlier using tools like WPScan or Shodan.
2. Obtain Privileged Access: Acquire Author or Developer-level credentials on the target WordPress site through phishing, credential stuffing, or brute force.
3. Identify Vulnerable Parameter: Locate the plugin functionality that accepts a filename or path parameter passed to a PHP include/require statement.
4. Craft LFI Payload: Manipulate the vulnerable parameter with a path traversal sequence (e.g., ../../../../wp-config.php) to reference a sensitive local file.
5. Retrieve Sensitive Data: Submit the crafted request and observe the server response, which may render the contents of the included file (e.g., database credentials from wp-config.php).
6. Escalate Access: Use exposed credentials to access the database directly or escalate privileges within the WordPress environment for further compromise (Patchstack).

• Logs: WordPress access logs showing unusual GET/POST requests to Sprout Invoices plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, or encoded variants) in file-related parameters.
• Logs: PHP error logs referencing unexpected file inclusion attempts or include/require failures for files outside the plugin directory.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other system configuration files.
• Network: Outbound connections from the web server to unknown external hosts following authenticated plugin interactions, which may indicate chained exploitation.

The vendor has released version 20.8.10 of the "Client Invoicing by Sprout Invoices" plugin, which patches this vulnerability. Site administrators should update to version 20.8.10 or later immediately via the WordPress plugin dashboard. If an immediate update is not possible, restrict Author/Developer role assignments to trusted users only, and consider using Patchstack's virtual patching feature to block exploitation attempts until the update can be applied (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through its Active VDP program, classifies it as low priority with unlikely exploitation impact. The vulnerability was reported by researcher "daroo" on January 22, 2026, and publicly disclosed on February 21, 2026. No significant broader media coverage or notable community discussion has been identified beyond the Patchstack advisory (Patchstack).