Executive brief
The Invoice Generator plugin for WordPress, used for creating and managing invoices, contains a critical security flaw that allows unauthorized individuals to take over any user account. By exploiting a missing security check, an attacker can change the email address associated with an administrator's account. Once the email is changed, the attacker can use the standard password reset process to gain full control of the website, potentially leading to data theft or complete site defacement.
Technical details
The vulnerability is a privilege escalation flaw caused by a missing capability check and lack of nonce verification in the 'pravel_invoice_edit_account()' AJAX action. The handler is registered via 'wp_ajax_nopriv_pravel_invoice_edit_account', making it accessible to unauthenticated users. An attacker can provide a targeted 'user_id' and a new 'user_email' via POST data, which the plugin passes directly to 'wp_update_user()'. By changing an administrator's email address to one they control, an attacker can initiate a password reset to gain full administrative access. The vulnerability affects all versions up to and including 1.0.0.
Affected products
- pravel Invoice Generator up to, and including, 1.0.0
Timeline
- 2026-06-27: disclosed: Published to the CVE list via Wordfence
References
- https://plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php
- https://plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php
- https://plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ee045d0d-101a-4ae2-b209-4a4865eec195?source=cve