CVE-2026-12417 describes an authentication bypass vulnerability in the pravel SignUp & SignIn WordPress plugin (up to version 1.0.0). The vulnerability exists in the `pravel_change_password()` AJAX handler, which is accessible to unauthenticated users via `wp_ajax_nopriv_pravel_change_password`. This handler does not perform nonce verification or capability checks and validates the `reset_activation_code` parameter against the user's `forgot_email` meta value using a loose equality check. If a user has never initiated a password reset, the meta value is empty, allowing an attacker to bypass the check by supplying an empty or omitted code. Consequently, an attacker can change the password of any user, including administrators, by sending a POST request with the target user ID and a new password. This leads to full account takeover and privilege escalation on the affected WordPress site.

Successful exploitation results in complete account takeover of any WordPress user, including administrators, on sites using the vulnerable plugin version. This allows attackers to authenticate as the compromised user with full privileges, leading to potential site compromise, data theft, or further malicious activity. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting its critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling or removing the pravel SignUp & SignIn plugin to prevent exploitation. Monitoring for unusual password changes and restricting access to admin-ajax.php may provide limited mitigation but do not fully address the vulnerability. Applying an official patch or update from the vendor once available is the recommended remediation.