CVE-2026-12415: WordPress Invoice Generator Plugin Unauthenticated Privilege Escalation

A critical privilege escalation vulnerability, tracked as CVE-2026-12415, has been identified in the Invoice Generator plugin for WordPress. This flaw impacts all plugin versions up to and including 1.0.0. The vulnerability stems from a missing capability check on the pravel_invoice_edit_account() AJAX action, which is exposed to unauthenticated users via wp_ajax_nopriv_pravel_invoice_edit_account. This specific handler accepts user_id and user_email parameters from POST data without verifying the requester's authentication status, ownership, or a nonce. This critical oversight allows unauthenticated attackers to arbitrarily change the email address of any user on the WordPress site, including administrative accounts. By exploiting this, attackers can trigger WordPress's password reset mechanism to gain full control over the compromised account.

Attack Chain

1. Discovery: An unauthenticated attacker identifies a WordPress instance running the vulnerable "Invoice Generator" plugin (versions up to and including 1.0.0).
2. Target Identification: The attacker identifies the user_id (e.g., typically 1 for the main administrator) and a legitimate administrator username on the target WordPress site.
3. Email Modification Request: The attacker sends an unauthenticated HTTP POST request to /wp-admin/admin-ajax.php with the action=pravel_invoice_edit_account parameter in the query string and includes the target user_id and a new, attacker-controlled user_email in the POST body or query parameters.
4. Vulnerability Trigger: The vulnerable plugin's pravel_invoice_edit_account() function, lacking proper authentication and authorization checks, processes the request and updates the target administrator's email address to the attacker-provided email.
5. Password Reset Initiation: The attacker navigates to the WordPress login page and initiates a password reset flow for the targeted administrator account using the administrator's username.
6. Password Reset Delivery: WordPress sends the password reset link to the newly assigned, attacker-controlled email address.
7. Account Takeover: The attacker accesses the attacker-controlled email inbox, clicks the password reset link, sets a new password, and successfully logs into the WordPress site as the administrator.
8. Impact: The attacker gains full administrative control over the WordPress site, enabling various malicious activities.

Impact

Successful exploitation of CVE-2026-12415 leads to complete administrative control over the affected WordPress site. This allows attackers to perform a wide range of damaging actions, including website defacement, injection of malicious code (e.g., for drive-by downloads or phishing campaigns), exfiltration of sensitive data from the site's database, or using the compromised site as a platform for further attacks. Organizations running the vulnerable plugin face a high risk of website takeover, reputational damage, and potential compliance breaches if sensitive customer data is stored on the platform.

Recommendation

• Prioritize patching the "Invoice Generator" WordPress plugin to a version greater than 1.0.0 immediately.
• Deploy the provided Sigma rule to your SIEM to detect exploitation attempts against CVE-2026-12415.
• Ensure web server access logs are collected for the webserver category, as this log source is crucial for detecting exploitation.