PT-2026-53043 · Undefined · Undefined

Published 2026-06-27 · Updated 2026-06-27 · CVE-2026-12415

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel invoice edit account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp ajax nopriv pravel invoice edit account, accepts an attacker-controlled user id and user email from POST data, and calls wp update user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-12415

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-12415 · Security Note
• https://plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php#L184 · Note
• https://plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php#L203 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ee045d0d-101a-4ae2-b209-4a4865eec195?source=cve · Note
• https://plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php#L193 · Note