CVE-2026-12416 describes a critical vulnerability in the pravel Invoice Generator WordPress plugin affecting all versions up to 1.0.0. The vulnerability arises because the `pravel_invoice_change_password()` function is exposed as a no-privilege AJAX handler without nonce verification or authorization checks. It performs a loose equality check between the supplied `reset_activation_code` and the user's stored `forgot_email` meta, which evaluates to true if the user has never initiated a password reset (empty strings compared loosely). This allows an attacker to omit the activation code and supply an arbitrary user ID to reset that user's password to an attacker-chosen value, enabling full account takeover, including administrator accounts.

Successful exploitation results in complete compromise of any user account on the affected WordPress site, including administrator accounts. This leads to full control over the site, including potential data theft, site defacement, or further malicious activity. The vulnerability has a CVSS 3.1 score of 9.8 (critical), reflecting its ease of exploitation (network, no privileges, no user interaction) and high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently available as per the provided data. Administrators should monitor the vendor's advisory for updates. Until a fix is released, restricting access to the AJAX endpoint or disabling the plugin may reduce risk. Avoid using affected versions (<=1.0.0) in production environments. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.