CVE-2026-12417 describes an authentication bypass vulnerability in the pravel SignUp & SignIn WordPress plugin (<=1.0.0). The vulnerability exists in the `pravel_change_password()` AJAX handler, which is accessible to unauthenticated users and does not perform nonce verification or capability checks. It only loosely compares an attacker-supplied `reset_activation_code` to the target user's `forgot_email` meta value. If the user has never initiated a password reset, this check can be trivially bypassed, allowing attackers to change any user's password by sending a crafted POST request to `admin-ajax.php` with specific parameters. Successful exploitation leads to full account takeover, including administrator-level privileges.

An attacker can fully compromise any user account on the affected WordPress site, including administrator accounts, by changing the password without authentication. This results in complete loss of confidentiality, integrity, and availability for the compromised accounts and potentially the entire site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AJAX endpoint if possible and monitor for suspicious POST requests targeting `action=pravel_change_password`. Avoid using the vulnerable plugin version and consider disabling or replacing it until patched.