Unauthenticated Account Takeover via Password Reset in Invoice Generator for WordPress
CVE-2026-12416 is a critical account takeover vulnerability in the Invoice Generator plugin for WordPress affecting all versions up to and including 1.0.0. The flaw is in the pravel_invoice_change_password() password-reset logic, which is exposed through a nopriv AJAX handler, allowing unauthenticated access. The function does not perform nonce verification or authorization checks, and it validates the supplied reset_activation_code POST parameter against the target user’s forgot_email user meta using a loose equality comparison. Because this comparison can evaluate true when both values are empty ('' == ''), an attacker can omit reset_activation_code entirely for users who have never initiated a forgot-password request and still satisfy the check. By supplying an arbitrary target account through the reset_user_id POST parameter and a new attacker-chosen password, an unauthenticated attacker can reset the password of any user, including administrators.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
admin-ajax.php actions associated with the plugin. Monitor for suspicious password reset events, unexpected account password changes, new administrator sessions, and other indicators of account takeover. Force password resets for potentially affected privileged accounts and review administrative users for unauthorized changes.Remediation
Patch, then assume compromise.
reset_user_id and reset-code inputs. If no patched version is available, disable or uninstall the plugin immediately on affected sites.Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit/scanner for two WordPress plugin vulnerabilities: CVE-2026-12416 in Invoice Generator <= 1.0.0 and CVE-2026-12417 in SignUp & SignIn <= 1.0.0. The repository contains one main code file, a README describing the vulnerabilities and workflow, and a custom license. The Python script is the operational entry point and implements concurrent mass scanning against a list of target WordPress sites. Core exploit capability: the script abuses unauthenticated WordPress AJAX handlers exposed through /wp-admin/admin-ajax.php using the actions pravel_change_password and pravel_invoice_change_password. It submits reset_user_id, an attacker-chosen new_password_custom value, and an empty reset_activation_code to trigger arbitrary password resets for guessed user IDs. The hardcoded replacement password is Nxploited@123KSa. Operational flow: for each target, the script first probes likely user IDs (1 and 2), then optionally expands to IDs 3 through 20 if needed. After a successful reset indication (matching the success string '"activation":true'), it attempts to determine the corresponding username using WordPress REST API endpoints and author enumeration techniques, then logs in through /wp-login.php. It confirms administrator access by requesting /wp-admin/users.php and checking whether the session has sufficient privileges. Confirmed admin compromises are written to scan_results/pravel_admin_success.txt. Repository structure is simple and purpose-built for exploitation rather than detection. It includes threading support via ThreadPoolExecutor for mass scanning, randomized User-Agent selection, timeout tuning, console output formatting with rich, and synchronized file/result handling. This is a real exploit with post-exploitation validation logic, not merely a detector or README-only proof of concept.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.