Account Takeover Vulnerability in Invoice Generator Plugin for WordPress

CVE-2026-12416

What is CVE-2026-12416?

The Invoice Generator plugin for WordPress is susceptible to an account takeover issue through its password reset feature. This vulnerability exists in all versions up to and including 1.0.0. Specifically, the flaw arises from the pravel_invoice_change_password() function, which is mistakenly registered as a nopriv AJAX handler. Due to the absence of nonce verification and proper authorization checks, an unauthenticated attacker can exploit this weakness. By manipulating the reset_user_id POST parameter, an attacker can evade the activation code verification process, which checks if the reset_activation_code matches with the user's stored email. Since this check can trivially succeed for users who have never requested a password reset, attackers gain the ability to set a new password for any account, including that of administrators, leading to full account compromise.

References