External risk intelligence

Sprout Invoices Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-64227

The vulnerability exists in a WordPress plugin designed for invoicing. Such plugins are commonly deployed on web-facing servers to facilitate customer interactions, payments, and document management, making the plugin's features and its attack surface accessible via the public internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in BoldGrid Client Invoicing by Sprout Invoices allows attackers to inject malicious objects through untrusted data deserialization, potentially impacting systems that use this invoicing software. The primary concern is to confirm if this specific software is in use within our environment.

Allows untrusted data to compromise software.
Impacts systems processing invoices.
Confirm relevance and exposure of invoicing software.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted data to the affected plugin over the network. This data, when processed by the plugin, can lead to the injection and execution of arbitrary code, potentially giving the attacker full control over the system.

No authentication or user interaction needed.
Untrusted data processed by the plugin.
Remote code execution and data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in BoldGrid Client Invoicing by Sprout Invoices could allow an attacker to inject malicious objects into the system. When supported by the advisory, this could occur when processing untrusted data, potentially affecting the integrity and availability of the invoicing service and any sensitive information it handles.

System and user data could be compromised.
Untrusted data processing may lead to exposure.
Service integrity and availability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical deserialization vulnerability in BoldGrid Client Invoicing by Sprout Invoices requires immediate attention. The application owner, likely within the finance or operations teams, is responsible for identifying all instances of the affected plugin, confirming their exposure and business criticality, and then coordinating remediation. Given the plugin's web-facing nature, security and infrastructure teams should collaborate to assess network exposure and implement temporary mitigations if direct patching is not feasible.

Application owners should lead remediation efforts.
Verify plugin presence and external reachability.
Plan for vendor coordination or temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the BoldGrid Client Invoicing plugin?

This software is a WordPress plugin developed by Sprout Invoices used for managing billing, customer payments, and document tracking. Businesses integrate it into their websites to automate invoicing workflows and allow clients to view or pay bills directly through the site interface.

How does this CVE-2025-64227 vulnerability work?

The flaw is identified as Deserialization of Untrusted Data (CWE-502). It occurs when the plugin processes input from a user without sufficient validation. Because the plugin interprets this data as an object, an attacker can manipulate the input to inject malicious instructions that the system then executes.

Do I need to be logged in for this to be triggered?

No. The vulnerability does not require authentication or any specific user interaction to be exploited. It is triggered simply by sending specially crafted data over the network to the plugin. If the plugin processes the input, the vulnerability can be triggered regardless of the sender's access level.

Why is this plugin considered high risk?

According to Halo Surface Signal, this plugin is typically deployed on web-facing servers to handle customer interactions. Because these features are designed to be accessible via the public internet, the attack surface for CVE-2025-64227 is broad, as attackers can reach the vulnerable code directly from outside your network.

What steps should I take if I use this software?

First, verify if your environment is running the affected plugin versions (n/a through 20.8.7). Once identified, collaborate with your finance or operations teams to assess the business impact of the software. Prioritize finding and applying official security updates from the vendor to resolve the flaw, while infrastructure teams evaluate temporary network-level mitigations if immediate patching is not possible.

References

patchstack.com/database/Wordpress/Plugin/sprout-invoices/vulnerabili…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.