CVE-2026-12416 describes a critical weakness in the pravel Invoice Generator WordPress plugin's password reset functionality. The function pravel_invoice_change_password() is registered as a no-privilege AJAX handler but lacks nonce verification and authorization checks. It performs a loose equality check between the provided reset_activation_code and the user's stored forgot_email meta, which evaluates to true if the user has never initiated a password reset (empty strings compared). Attackers can omit the reset_activation_code and supply an arbitrary reset_user_id to reset any user's password, enabling full account takeover, including administrators. This vulnerability affects all versions up to and including 1.0.0.

Successful exploitation allows unauthenticated attackers to reset passwords of any user on the WordPress site running the vulnerable plugin, including administrator accounts. This leads to complete account takeover, compromising confidentiality, integrity, and availability of the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX handler if possible or disable the plugin. Monitor vendor channels for updates and apply patches promptly once released.