CVE-2026-12416: Invoice Generator Auth Bypass Vulnerability

CVE-2026-12416 Overview

CVE-2026-12416 is a critical account takeover vulnerability in the Invoice Generator plugin for WordPress, affecting all versions up to and including 1.0.0. The flaw resides in the pravel_invoice_change_password() function, which is registered as an unauthenticated AJAX handler without nonce verification or authorization checks. Unauthenticated attackers can reset the password of any WordPress account — including administrator accounts — by submitting a single crafted request. Successful exploitation grants full administrative control over the affected WordPress site.

Critical Impact
Unauthenticated attackers can take over administrator accounts on any WordPress site running the Invoice Generator plugin version 1.0.0 or earlier, leading to full site compromise.

Affected Products

Invoice Generator plugin for WordPress (slug: invoice-creator)
All versions up to and including 1.0.0
WordPress installations exposing the plugin's nopriv AJAX endpoint

Discovery Timeline

2026-06-24 - CVE-2026-12416 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-12416

Vulnerability Analysis

The vulnerability is classified under [CWE-640] Weak Password Recovery Mechanism for Forgotten Password. The Invoice Generator plugin registers pravel_invoice_change_password() as a wp_ajax_nopriv_ handler, meaning unauthenticated visitors can invoke it directly through admin-ajax.php. The handler omits two foundational WordPress security controls: nonce verification with check_ajax_referer() and capability checks with current_user_can(). As a result, no token or session binds the request to a legitimate password reset workflow.

The handler accepts a reset_user_id POST parameter that designates which account receives the new password and a reset_activation_code parameter that is supposed to validate the request. The function then compares the supplied activation code against the target user's stored forgot_email user meta value using PHP's loose equality operator (==).

Root Cause

For any user who has never initiated a forgot-password flow, the forgot_email user meta value is empty. When the attacker omits reset_activation_code from the request, PHP evaluates '' == '' as true, satisfying the activation check. Administrator accounts typically never use the plugin's forgot-password flow, leaving their forgot_email meta empty and making them prime targets. The handler then calls wp_set_password() with attacker-supplied input, overwriting the victim's credentials.

Attack Vector

The vulnerability is exploited remotely over the network with no authentication or user interaction. An attacker sends a POST request to /wp-admin/admin-ajax.php with action=pravel_invoice_change_password, a reset_user_id set to 1 (the default administrator), and a new password value. Because reset_activation_code is omitted, the loose comparison passes, and the administrator password is rewritten. The attacker can then authenticate to /wp-login.php with the chosen credentials and execute arbitrary administrative actions, including plugin installation and PHP code execution.

See the Wordfence Vulnerability Report and the Invoice Creator source on plugins.trac for the affected code paths.

Detection Methods for CVE-2026-12416

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=pravel_invoice_change_password from unauthenticated sessions
Requests carrying reset_user_id parameters referencing administrator user IDs without an accompanying reset_activation_code value
Unexpected wp_users.user_pass hash changes on accounts that did not initiate a password reset
New administrator logins from unfamiliar IP addresses immediately following the request pattern above

Detection Strategies

Inspect web server and WordPress access logs for admin-ajax.php requests where the action parameter equals pravel_invoice_change_password
Correlate password change audit events with the absence of a preceding forgot-password email or user-initiated request
Monitor for installation of unfamiliar plugins or theme file modifications that follow administrator password changes

Monitoring Recommendations

Enable WordPress audit logging plugins to record password changes, user role modifications, and plugin installations
Forward web server logs and WordPress audit events to a centralized SIEM for correlation and alerting on the parameter signatures above
Alert on any administrator authentication originating from IP addresses or user agents that have never previously logged in

How to Mitigate CVE-2026-12416

Immediate Actions Required

Deactivate and remove the Invoice Generator plugin (invoice-creator) from all WordPress installations until a patched version is available
Rotate passwords for all administrator and privileged accounts on affected sites and enforce strong, unique credentials
Review the WordPress user list for unauthorized accounts and remove any that were not provisioned by an administrator
Audit recently installed plugins, themes, and uploaded files for backdoors introduced after a suspected compromise

Patch Information

At the time of publication, no fixed version of the Invoice Generator plugin had been released. The advisory covers all versions up to and including 1.0.0. Monitor the Invoice Creator plugin page on plugins.trac and the Wordfence Vulnerability Report for patch availability.

Workarounds

Block requests to admin-ajax.php containing the pravel_invoice_change_password action at the web application firewall or reverse proxy layer
Restrict access to /wp-admin/admin-ajax.php from untrusted networks where the plugin's customer-facing functionality is not required
Enable multi-factor authentication for all administrator accounts so that a password reset alone does not yield account access

bash

# Example nginx rule to block exploitation attempts
if ($arg_action = "pravel_invoice_change_password") {
    return 403;
}
if ($request_body ~* "action=pravel_invoice_change_password") {
    return 403;
}