CVE-2026-12416

Name of the Vulnerable Software and Affected Versions Invoice Generator plugin for WordPress versions prior to 1.0.1

Description The Invoice Generator plugin for WordPress allows unauthenticated account takeover through a flaw in the password reset process. The pravel invoice change password() function is registered as a nopriv AJAX handler but lacks nonce verification and authorization checks. Additionally, it uses a loose equality comparison between the reset activation code POST parameter and the forgot email user meta. For users who have never requested a password reset, this check evaluates to true when the reset activation code is omitted. An attacker can exploit this by providing a target user ID via the reset user id POST parameter to set a new password for any account, including administrator accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, disable the Invoice Generator plugin to minimize the risk of exploitation.