CVE-2026-12415 describes a critical privilege escalation vulnerability in the pravel Invoice Generator WordPress plugin. The issue is due to the pravel_invoice_edit_account() AJAX handler being exposed via wp_ajax_nopriv_pravel_invoice_edit_account without proper capability checks. The handler accepts attacker-controlled user_id and user_email parameters and calls wp_update_user() without verifying the requester's authentication, ownership of the account, or a nonce token. This flaw enables unauthenticated attackers to change the email address of any user, including administrators, and subsequently exploit WordPress's password reset mechanism to gain unauthorized access to those accounts. The vulnerability affects versions up to and including 1.0.0. No official patch or remediation guidance has been provided at this time.

An unauthenticated attacker can escalate privileges by changing the email address of any user, including administrators, in the WordPress system. This enables the attacker to trigger password reset flows and gain full control over targeted accounts. The vulnerability impacts confidentiality, integrity, and availability of the affected WordPress site, potentially leading to complete site compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable AJAX action by disabling the plugin or applying custom access controls to prevent unauthenticated requests to pravel_invoice_edit_account(). Monitor for updates from the vendor regarding an official fix.