What is the CVSS score of CVE-2026-12415?

CVE-2026-12415 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Invoice Generator are affected by CVE-2026-12415?

The Pravel Invoice Generator WordPress plugin through version 1.0.0 contains a critical unauthenticated account takeover vulnerability enabling attackers to hijack any administrator account by…

Is there a public PoC exploit available for CVE-2026-12415?

Yes, a public proof-of-concept exploit is available for CVE-2026-12415. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2026-12415?

Within 24 hours: Audit all WordPress installations for Pravel Invoice Generator plugin and immediately disable or remove it from production environments. Within 7 days: Identify and deploy an alternative invoice generation solution; audit admin account access logs for suspicious password resets or unauthorized email changes; reset all administrator account credentials. Within 30 days: Complete migration away from Pravel plugin; conduct forensic review of user account modifications and privilege escalations occurring during exposure; implement Web Application Firewall rules to block wp-admin/admin-ajax.php requests from untrusted sources.

Invoice Generator CVE-2026-12415

EUVD-2026-39943 CRITICAL

Improper Privilege Management (CWE-269)

2026-06-27 Wordfence

GHSA-f3q2-677p-c93v

WordPress Privilege Escalation Wordpress Plugin Invoice Generator Pravel

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network AJAX endpoint (AV:N/PR:N/UI:N) with trivial exploitation (AC:L) yields full admin takeover, giving total C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 27, 2026 - 04:59 vuln.today

CVE Published

Jun 27, 2026 - 04:30 cve.org

CRITICAL 9.8

DescriptionCVE.org

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.

Articles & Coverage 2

News Critical Account Takeover in WordPress Invoice Generator (Pravel) Plugin - CVE-2026-12415 Jun 27, 2026 POC PoC Exploit Released for CVE-2026-12415 and CVE-2026-12416 Jun 26, 2026

AnalysisAI

Account takeover in the Invoice Generator (Pravel) plugin for WordPress through version 1.0.0 lets unauthenticated attackers hijack any account, including administrators. The pravel_invoice_edit_account() AJAX handler is registered for unauthenticated users and calls wp_update_user() with attacker-supplied user_id and user_email without any capability check, nonce, or ownership verification, so an attacker can overwrite an admin's email and then drive the password-reset flow to seize the account. Rated CVSS 9.8 and reported by Wordfence; no public exploit identified at time of analysis and it is not in CISA KEV.

Technical ContextAI

The flaw lives in the plugin's user-management code (lib/user-manage-function.php around lines 184-203). WordPress AJAX actions are wired through two hooks: wp_ajax_{action} for logged-in users and wp_ajax_nopriv_{action} for anonymous requests. Here the handler is bound to wp_ajax_nopriv_pravel_invoice_edit_account, exposing it to anyone who can reach admin-ajax.php, and it passes POST-controlled user_id/user_email straight into the core wp_update_user() function. This is a classic CWE-269 (Improper Privilege Management): a state-changing, privileged operation lacks the current_user_can() capability gate, the check_ajax_referer() nonce, and any check that the caller owns the target account. The affected product is identified by CPE cpe:2.3:a:pravel:invoice_generator:*:*:*:*:*:*:*:* covering all versions up to and including 1.0.0.

RemediationAI

No fixed version is stated in the provided data, so treat this as: no vendor-released patched version independently confirmed at time of analysis - monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ee045d0d-101a-4ae2-b209-4a4865eec195?source=cve) and the plugin page for an update beyond 1.0.0 and apply it immediately when released. Because the plugin only reaches version 1.0.0 and the flaw allows full administrator takeover, the safest interim action is to deactivate and remove the Invoice Generator plugin entirely, accepting loss of its invoicing functionality. If removal is not feasible, compensating controls include blocking unauthenticated POST requests to /wp-admin/admin-ajax.php with action=pravel_invoice_edit_account at a WAF or reverse proxy (low side-effect, since legitimate use of this action by anonymous users should not occur), and tightening monitoring/alerting on unexpected administrator email-address changes and password-reset requests so a takeover attempt is caught. After applying any control, audit all administrator accounts for altered email addresses.