CVE-2026-12415: Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravelinvoiceeditaccount() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wpajaxnoprivpravelinvoiceeditaccount, accepts an attacker-controlled userid and useremail from POST data, and calls wpupdateuser() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pravel_invoice_generator (WordPress)to a version that resolves this vulnerability.Fixed in 1.0.0 - Configuration
Update the pravel_invoice_edit_account AJAX handler to require authentication (not nopriv), check that the caller is allowed to edit the target user, validate/verify nonce from POST, and only then call wp_update_user().
pravel_invoice_edit_account AJAX handler (WordPress) wp_ajax_nopriv_pravel_invoice_edit_account capability/authentication check and nonce verification = Add required capability check, verify authentication/ownership, and require a valid nonce before calling wp_update_user() - Compensating control
Ensure the exposed AJAX action wp_ajax_nopriv_pravel_invoice_edit_account is not available publicly; remove/disable the unauthenticated (nopriv) registration so only authenticated, authorized users can invoke pravel_invoice_edit_account.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12415?
The severity of CVE-2026-12415 is rated as critical with a score of 9.8.
How do I fix CVE-2026-12415?
To fix CVE-2026-12415, update the Invoice Generator plugin to version 1.0.1 or later.
What type of vulnerability is CVE-2026-12415?
CVE-2026-12415 is an unauthenticated privilege escalation vulnerability.
Which versions are affected by CVE-2026-12415?
CVE-2026-12415 affects the Invoice Generator plugin versions up to and including 1.0.0.
What is the exploit method for CVE-2026-12415?
CVE-2026-12415 can be exploited via an account takeover using the 'user_id' parameter without proper capability checks.