Executive brief
The Invoice Generator plugin for WordPress, used for creating and managing invoices, contains a critical security flaw that allows anyone to take over any user account. By exploiting a weakness in the password reset process, an attacker can change the password of any user, including site administrators, without needing any existing credentials. This could lead to a total loss of control over the website and exposure of sensitive customer and financial data.
Technical details
The vulnerability exists in the `pravel_invoice_change_password()` function, which is registered as a nopriv AJAX handler. The function lacks nonce verification and authorization checks. Furthermore, it performs a loose equality comparison between a user-supplied `reset_activation_code` and the stored `forgot_email` user meta. Because this meta value is empty for users who have not requested a password reset, an attacker can bypass the check by providing an empty activation code. By supplying a target `reset_user_id`, an unauthenticated attacker can successfully update the password for any account.
Affected products
- Pravel Invoice Generator <= 1.0.0
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://plugins.trac.wordpress.org/browser/invoice-creator/tags/1.0.0/lib/user-manage-function.php
- https://plugins.trac.wordpress.org/browser/invoice-creator/tags/1.0.0/lib/user-manage-function.php
- https://plugins.trac.wordpress.org/browser/invoice-creator/tags/1.0.0/lib/user-manage-function.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0fbe84-e455-4e62-9c48-49340d08f81d?source=cve