EUVD-2026-38680
GHSA-5656-6hgp-4v5v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network POST with no user interaction trivially takes over admin accounts, yielding full confidentiality, integrity, and availability impact on the WordPress site.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the pravel_invoice_change_password() function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied reset_activation_code POST parameter and the target user's stored forgot_email user meta - a check that trivially evaluates to true ('' == '') for any user who has never initiated a forgot-password request, which applies to administrators under normal conditions. This makes it possible for unauthenticated attackers to supply an arbitrary user ID via the reset_user_id POST parameter, bypass the activation code check entirely by omitting reset_activation_code, and set the target account's password to an attacker-chosen value, enabling full takeover of any account on the site, including administrator accounts.
Articles & Coverage 4
AnalysisAI
Account takeover in the Invoice Generator WordPress plugin (versions through 1.0.0) allows unauthenticated remote attackers to reset the password of any user, including administrators, by abusing the nopriv pravel_invoice_change_password() AJAX handler. Reported by Wordfence with a CVSS of 9.8 and tagged for RCE potential via subsequent admin compromise; no public exploit identified at time of analysis, though the trivial nature of the bug makes weaponization straightforward.
Technical ContextAI
The affected component is the Pravel Invoice Generator plugin for WordPress (CPE cpe:2.3:a:pravel:invoice_generator), specifically the pravel_invoice_change_password() function in lib/user-manage-function.php. The root cause is CWE-640 (Weak Password Recovery Mechanism for Forgotten Password): the function is registered as a wp_ajax_nopriv_ handler - exposing it to unauthenticated requests - without nonce verification or capability checks, and validates the reset by performing a loose PHP equality () between the attacker-controlled reset_activation_code POST parameter and the target user's forgot_email user meta. Because most users (especially administrators) have never invoked the forgot-password flow, that meta value is empty, and '' '' evaluates true when the attacker omits the parameter, completely bypassing identity verification before the password is overwritten.
RemediationAI
No vendor-released patch identified at time of analysis; the plugin's latest published version (1.0.0) remains vulnerable per the references. As an immediate compensating control, deactivate and remove the Invoice Generator plugin from any WordPress site where it is installed - this fully eliminates exposure, with the trade-off of losing invoice-generation functionality until a fixed release or alternative plugin is adopted. If removal is not possible, block unauthenticated POST requests to /wp-admin/admin-ajax.php where the action parameter equals pravel_invoice_change_password at the WAF or reverse proxy (Wordfence rules cover this), accepting the side effect that legitimate password-reset flows through the plugin will also break. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0fbe84-e455-4e62-9c48-49340d08f81d for a patched version and audit administrator accounts and user_meta for unexpected password changes.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Share
External POC / Exploit Code
Leaving vuln.today