EUVD-2026-39943
GHSA-f3q2-677p-c93v
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network AJAX endpoint (AV:N/PR:N/UI:N) with trivial exploitation (AC:L) yields full admin takeover, giving total C/I/A impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.
Articles & Coverage 2
AnalysisAI
Account takeover in the Invoice Generator (Pravel) plugin for WordPress through version 1.0.0 lets unauthenticated attackers hijack any account, including administrators. The pravel_invoice_edit_account() AJAX handler is registered for unauthenticated users and calls wp_update_user() with attacker-supplied user_id and user_email without any capability check, nonce, or ownership verification, so an attacker can overwrite an admin's email and then drive the password-reset flow to seize the account. Rated CVSS 9.8 and reported by Wordfence; no public exploit identified at time of analysis and it is not in CISA KEV.
Technical ContextAI
The flaw lives in the plugin's user-management code (lib/user-manage-function.php around lines 184-203). WordPress AJAX actions are wired through two hooks: wp_ajax_{action} for logged-in users and wp_ajax_nopriv_{action} for anonymous requests. Here the handler is bound to wp_ajax_nopriv_pravel_invoice_edit_account, exposing it to anyone who can reach admin-ajax.php, and it passes POST-controlled user_id/user_email straight into the core wp_update_user() function. This is a classic CWE-269 (Improper Privilege Management): a state-changing, privileged operation lacks the current_user_can() capability gate, the check_ajax_referer() nonce, and any check that the caller owns the target account. The affected product is identified by CPE cpe:2.3:a:pravel:invoice_generator:*:*:*:*:*:*:*:* covering all versions up to and including 1.0.0.
RemediationAI
No fixed version is stated in the provided data, so treat this as: no vendor-released patched version independently confirmed at time of analysis - monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ee045d0d-101a-4ae2-b209-4a4865eec195?source=cve) and the plugin page for an update beyond 1.0.0 and apply it immediately when released. Because the plugin only reaches version 1.0.0 and the flaw allows full administrator takeover, the safest interim action is to deactivate and remove the Invoice Generator plugin entirely, accepting loss of its invoicing functionality. If removal is not feasible, compensating controls include blocking unauthenticated POST requests to /wp-admin/admin-ajax.php with action=pravel_invoice_edit_account at a WAF or reverse proxy (low side-effect, since legitimate use of this action by anonymous users should not occur), and tightening monitoring/alerting on unexpected administrator email-address changes and password-reset requests so a takeover attempt is caught. After applying any control, audit all administrator accounts for altered email addresses.
More in Invoice Generator
View allSame weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today