CVE Intelligence
Analysis AI-assisted

CVE-2026-12415: Invoice Generator (WordPress) - Missing Capability Check Enables Privilege Escalation

CVE-2026-12415 affects the Invoice Generator plugin for WordPress in versions up to and including 1.0.0. A missing capability check in an AJAX action allows unauthenticated users to change the email address of any account, including administrators. The CNA Wordfence rates it Critical with a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Invoice Generator plugin for WordPress contains a missing capability check in its pravel_invoice_edit_account() AJAX action. The weakness is classified as CWE-269 (Improper Privilege Management) and affects versions up to and including 1.0.0. Source details are in the Wordfence advisory and the plugin source.

Impact

  • According to the record, an unauthenticated attacker could change the email address of any user, including administrators.
  • The record states that the changed email can then be used with WordPress's password reset flow to gain access to the targeted account.
  • The CVSS 3.1 base score of 9.8 (Critical) assigned by the CNA reflects high impact to confidentiality, integrity and availability, with no privileges or user interaction required.

Affected products and versions

  • Invoice Generator plugin for WordPress, versions up to and including 1.0.0.
  • The record contains no structured affected or fixed version data. The referenced source lines are in the invoice-creator trunk code.

Exploitation status

The CISA KEV catalog does not list this CVE according to the record. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • The record does not identify a fixed version. Check the plugin's official listing and vendor channels for an update and apply it when one is available.
  • If no fix is available, deactivate and remove the plugin, or restrict access to the affected AJAX endpoint at the web application layer.
  • Review administrator and user accounts for unexpected email address changes and confirm that password reset notices reach the intended owners.
  • Enforce multi-factor authentication on administrator accounts to reduce the impact of an account recovery abuse.

Detection guidance

  • Review web server and WordPress logs for unauthenticated requests to the admin AJAX endpoint that reference the pravel_invoice_edit_account action.
  • Audit recent changes to user email addresses, particularly for administrator accounts, and correlate them with password reset events.
  • Alert on password reset activity followed by logins from unfamiliar sources.

Limitations of the available information

  • The record does not provide a fixed version, vendor-confirmed patch status, or the number of installations.
  • EPSS values (probability 0.00804, percentile 0.55607) estimate likelihood of exploitation and do not confirm observed exploitation.
  • The scope of affected deployments is unknown from the record.

Frequently asked questions

Which versions of the Invoice Generator plugin are affected?

The record states that versions up to and including 1.0.0 are affected. It does not list a fixed version.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should site owners do now?

Check the plugin vendor for an update, deactivate or remove the plugin if no fix exists, review account email changes, and enable multi-factor authentication for administrators.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.