CVE-2026-12415 is a critical privilege escalation vulnerability in the pravel Invoice Generator WordPress plugin (versions <=1.0.0). The AJAX action pravel_invoice_edit_account() is exposed without proper capability checks or nonce verification via wp_ajax_nopriv_pravel_invoice_edit_account. This allows unauthenticated attackers to modify the email address of arbitrary users by supplying attacker-controlled user_id and user_email parameters. The plugin then calls wp_update_user() without verifying authentication or ownership, enabling attackers to hijack accounts by initiating password resets.

An unauthenticated attacker can change the email address of any user, including administrators, in the vulnerable plugin versions. This enables the attacker to initiate a password reset flow for the targeted account, potentially leading to full account takeover. The vulnerability impacts confidentiality, integrity, and availability of user accounts on affected WordPress sites.

No official patch or remediation is currently available for this vulnerability. Users of the Invoice Generator plugin version 1.0.0 or earlier should consider disabling or removing the plugin until a fix is released. Monitor the vendor's advisory channels for updates and apply any official fixes promptly once available. Implementing additional access controls or web application firewall rules to block unauthorized access to the vulnerable AJAX endpoint may provide temporary mitigation.