CVE-2026-12415

Name of the Vulnerable Software and Affected Versions Invoice Generator versions prior to 1.0.1

Description The Invoice Generator plugin for WordPress allows privilege escalation because it fails to perform a capability check on the pravel invoice edit account() AJAX action. The handler is exposed via the wp ajax nopriv pravel invoice edit account endpoint and accepts the user id and user email variables from POST data. Because the plugin calls wp update user() without verifying authentication, ownership, or a nonce, unauthenticated attackers can change the email address of any user, including administrators. This allows them to trigger the password reset flow and gain unauthorized access to the targeted account.

Recommendations Update the plugin to a version newer than 1.0.0.