CVE Intelligence
Analysis AI-assisted

CVE-2026-12416: Invoice Generator WordPress Plugin - Account Takeover via Password Reset

The Invoice Generator plugin for WordPress has a password reset flaw that lets unauthenticated attackers set the password of arbitrary accounts, including administrators. The record states that all versions up to and including 1.0.0 are affected and rates the issue critical with CVSS 3.1 base score 9.8. The record lists no fixed version and no confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The Invoice Generator plugin for WordPress contains a flaw in its password reset handling that can let unauthenticated visitors change the password of WordPress accounts, including administrator accounts. The affected handler is reachable without logging in and lacks nonce and authorization checks, and the reset code comparison is weak.

Impact

  • An unauthenticated attacker may be able to take over any account on an affected site.
  • Takeover of an administrator account would allow control over site content, plugins, users and settings.
  • The record rates the issue critical, with CVSS 3.1 base score 9.8 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, as provided by the CNA.

Affected products and versions

  • Product: Invoice Generator plugin for WordPress.
  • Versions: the description states all versions up to and including 1.0.0.
  • The structured affected-version field in the record is empty, so the exact range should be confirmed against the references and vendor information.

Exploitation status

  • The record does not list this CVE in CISA KEV, so active exploitation is not confirmed by that source.
  • No confirmed exploitation in the wild appears in the sources consulted for this analysis.

Remediation and mitigation

  • The record lists no fixed version. Check the plugin's current release and changelog before assuming a fix exists.
  • If the plugin is installed and no verified fixed version is available, deactivating and removing it reduces exposure.
  • After reviewing the site, reset passwords for administrator and other privileged accounts, especially on sites where the plugin was reachable from the internet.
  • Keep WordPress core and other plugins updated and limit unnecessary public exposure of administrative functions.

Detection guidance

  • Review web server and application logs for unauthenticated requests to the WordPress AJAX endpoint that relate to password or account functions of this plugin.
  • Look for unexpected password changes, new administrator accounts or altered user profiles, particularly for accounts that never requested a password reset.
  • Correlate such events with the presence and version of the plugin on the site.

Limitations of the available information

  • The record contains no fixed version, no structured affected-version data, no EPSS score and no SSVC data.
  • The record status is Deferred, and this analysis relies only on the description and the listed references.
  • The plugin slug in the reference URLs (invoice-creator) differs from the product name in the description; confirm that both refer to the same plugin.

Frequently asked questions

Which versions of the Invoice Generator plugin are affected?

The description states that all versions up to and including 1.0.0 are affected. The record does not provide structured affected-version data, so confirm the exact range with the references.

Is this vulnerability being actively exploited?

The record does not list CVE-2026-12416 in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.