Vendor
An authentication bypass vulnerability (CVE-2026-12415) in the Invoice Generator plugin for WordPress (versions up to and including 1.0.0) allows unauthenticated attackers to perform privilege escalation by modifying the email address of any user, including administrators, and subsequently gaining full account control via a password reset.