CyberRota Analysis
AI-GeneratedThe Sprout Invoices WordPress plugin prior to version 20.8.16 is vulnerable to unauthorized overwriting of private notes due to a lack of capability and ownership checks in its AJAX actions. This flaw allows any authenticated user, including those with minimal permissions like subscribers, to modify private notes belonging to other users, potentially leading to data leakage or unauthorized information manipulation. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through one of its AJAX actions, allowing any authenticated user such as a subscriber to overwrite private notes on records belonging to other users.