UNKNOWN NVD

CVE-2026-87797

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through o

The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.

References

https://wpscan.com/vulnerability/ded55e47-568d-4702-b043-4707e4182a09/

Published: 2026-09-12 · Source: NVD · Feed updated: 2026-09-12

This unknown severity vulnerability was published on 2026-09-12 via NVD.

vulnfeed aggregates 12854 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.