CVE-2026-12415

🗓️ 27 Jun 2026 04:30:30Reported by WordfenceType

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_...

Reporter	Title	Published	Views	Family All 3
ATTACKERKB	CVE-2026-12415	27 Jun 202604:30	–	attackerkb
Cvelist	CVE-2026-12415 Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter	27 Jun 202604:30	–	cvelist
NVD	CVE-2026-12415	27 Jun 202605:16	–	nvd

Vulners

Node

pravel invoice_generatorRange≤1.0.0wordpress

[
  {
    "vendor": "pravel",
    "product": "Invoice Generator",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/ee045d0d-101a-4ae2-b209-4a4865eec195
plugins	www.plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php
plugins	www.plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php
plugins	www.plugins.trac.wordpress.org/browser/invoice-creator/trunk/lib/user-manage-function.php

27 Jun 2026 05:16Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.8

CWE-269