Skip to content
Threat Feed
Subscribe

Product

Invoice Generator Plugin <= 1.0.0 (<= 1.0.0)

1 brief RSS
critical advisory

CVE-2026-12415: WordPress Invoice Generator Plugin Unauthenticated Privilege Escalation

An authentication bypass vulnerability (CVE-2026-12415) in the Invoice Generator plugin for WordPress (versions up to and including 1.0.0) allows unauthenticated attackers to perform privilege escalation by modifying the email address of any user, including administrators, and subsequently gaining full account control via a password reset.

PoC Invoice Generator plugin <= 1.0.0 wordpress plugin privilege-escalation webserver cve
1r 2t 2c updated