What the vulnerability does
01Description
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.
Explanation of Vulnerability in Simple Terms
02Summary
Pravel Invoice Generator versions 1.0.0 and earlier contain a privilege management flaw that allows unauthenticated attackers to read, modify, and delete data on the site without any user interaction. The vulnerability stems from improper access controls that fail to restrict sensitive operations. All users of affected versions should update immediately.
What an attacker can do
03Attacker Capabilities
Read, modify, and delete invoices and other data without logging in.
Potential impact on your site
04Site Impact
Attackers can access, alter, or destroy invoice records and potentially other sensitive business data.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
June 27, 2026
CVE published
June 29, 2026
Record updated
