A critical PHP object injection vulnerability in the Sprout Invoices WordPress plugin allows unauthenticated attackers to achieve remote code execution.

The plugin improperly handles serialized data, allowing an unauthenticated attacker to inject malicious PHP objects (CWE-502) and execute arbitrary code.

With a CVSS score of 9.8, this vulnerability poses a severe threat to business continuity and data integrity. Successful exploitation could result in the total compromise of the WordPress environment, providing attackers with the ability to intercept sensitive billing data and execute arbitrary commands on the server.

Immediate Action: Update the Sprout Invoices plugin to version 20.8.8 or later immediately.

Proactive Monitoring: Review logs for anomalous file uploads or unexpected PHP execution patterns that may indicate an attempt to leverage the deserialization flaw.

Compensating Controls: Implement a WAF to filter malicious serialized payloads from incoming traffic to the site.

Public Exploit Available: Unknown

Organizations utilizing the Sprout Invoices plugin must prioritize updating to version 20.8.8 without delay. Failure to apply this patch leaves the application exposed to critical remote code execution risks.