Unauthenticated Account Takeover via Password Reset in Invoice Generator for WordPress
CVE-2026-12416 affects the Invoice Generator plugin for WordPress in all versions up to and including 1.0.0. The vulnerability is in the pravel_invoice_change_password() function, which is exposed through a nopriv AJAX handler and does not enforce nonce verification or authorization checks. The function validates the supplied reset_activation_code POST parameter against the target user’s forgot_email user meta using a loose equality comparison. For users who have never initiated a forgot-password flow, that stored value can be empty, allowing the comparison to succeed when the attacker omits the reset code and both sides evaluate as empty ('' == ''). An unauthenticated attacker can therefore submit an arbitrary reset_user_id, bypass the intended reset-token validation, and set a new password for the targeted account. This results in direct password reset abuse and full takeover of arbitrary accounts, including administrator accounts.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
admin-ajax.php actions associated with the plugin, via WAF or web-server controls. Monitor for suspicious password reset events, unexpected account password changes, new administrator sessions, and unauthorized administrative actions. Review user accounts for compromise and reset credentials for potentially affected users, especially administrators.Remediation
Patch, then assume compromise.
reset_user_id and reset_activation_code. If no patched version is available, disable or uninstall the plugin immediately.Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone Python exploit/scanner for two WordPress plugin vulnerabilities: CVE-2026-12416 in Invoice Generator <= 1.0.0 and CVE-2026-12417 in SignUp & SignIn <= 1.0.0. The repository contains one main code file, a README describing the vulnerabilities and workflow, and a custom license. The Python script is the operational entry point and implements concurrent mass scanning against a list of target WordPress sites. Core exploit capability: the script abuses unauthenticated WordPress AJAX handlers exposed through /wp-admin/admin-ajax.php using the actions pravel_change_password and pravel_invoice_change_password. It submits reset_user_id, an attacker-chosen new_password_custom value, and an empty reset_activation_code to trigger arbitrary password resets for guessed user IDs. The hardcoded replacement password is Nxploited@123KSa. Operational flow: for each target, the script first probes likely user IDs (1 and 2), then optionally expands to IDs 3 through 20 if needed. After a successful reset indication (matching the success string '"activation":true'), it attempts to determine the corresponding username using WordPress REST API endpoints and author enumeration techniques, then logs in through /wp-login.php. It confirms administrator access by requesting /wp-admin/users.php and checking whether the session has sufficient privileges. Confirmed admin compromises are written to scan_results/pravel_admin_success.txt. Repository structure is simple and purpose-built for exploitation rather than detection. It includes threading support via ThreadPoolExecutor for mass scanning, randomized User-Agent selection, timeout tuning, console output formatting with rich, and synchronized file/result handling. This is a real exploit with post-exploitation validation logic, not merely a detector or README-only proof of concept.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.