CVE-2026-12416: Invoice Generator <= 1.0.0…

Record summary

CVE-2026-12416 has a selected CVSS score of 9.8 (critical); EIP currently links 2 repository PoCs.

Description

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parameter and the target user's stored `forgot_email` user meta — a check that trivially evaluates to true (`'' == ''`) for any user who has never initiated a forgot-password request, which applies to administrators under normal conditions. This makes it possible for unauthenticated attackers to supply an arbitrary user ID via the `reset_user_id` POST parameter, bypass the activation code check entirely by omitting `reset_activation_code`, and set the target account's password to an attacker-chosen value, enabling full takeover of any account on the site, including administrator accounts.

Description source: CVE List

Exploitation context

Available material

Repository PoCs: 2

CISA SSVC decision

ExploitationNone

AutomatableYes

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 25, 2026 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
Invoice Generator Browse pravel / Invoice Generator Default status: unaffected	CVE List	Through 1.0.0	affected

Proofs of concept

Repository PoCs

GitHubNxploited/CVE-2026-12416-CVE-2026-12417Repository PoCby Nxploited2Exploit3 files

23.3 KiB · linked to 2 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

Python script that performs unauthenticated password reset on WordPress sites via vulnerable AJAX handlers (CVE-2026-12416, CVE-2026-12417), then attempts to log in and verify administrator access, saving confirmed credentials.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python mass-exploitation scanner and a README that describe and implement unauthenticated password-reset attacks against two known WordPress plugin vulnerabilities (CVE-2026-12416 and CVE-2026-12417). The code performs exactly the advertised exploit behavior: sending crafted AJAX requests to reset passwords, attempting login, verifying admin access, and saving results. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit is present in the reviewed text.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPython

Target softwareWordPressSignUp & SignIn pluginInvoice Generator plugin

Attack typesAccount TakeoverAuthentication BypassPrivilege Escalation

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script actively changes user passwords on remote targets (line 186-212) and then uses the new credentials to authenticate and verify admin access (line 321-389). This goes beyond detection or scanning; it exercises the vulnerability to achieve account takeover, which is the definition of an exploit.

CVE-2026-12416--CVE-2026-12417.py:186-212CVE-2026-12416--CVE-2026-12417.py:321-389

Requirements

Target WordPress site must have vulnerable SignUp & SignIn or Invoice Generator plugin (<=1.0.0) installed and accessible.README.md:14-38
Attacker must supply a list of target URLs in a file.CVE-2026-12416--CVE-2026-12417.py:456-457

Observed behavior

Sends POST request to /wp-admin/admin-ajax.php with action=pravel_change_password or pravel_invoice_change_password, an empty reset_activation_code, and attacker-chosen new_password_custom to reset a user's password.CVE-2026-12416--CVE-2026-12417.py:186-212
After a successful password reset, enumerates usernames via REST API and author redirects, then attempts to log in to /wp-login.php with the new password.CVE-2026-12416--CVE-2026-12417.py:280-305CVE-2026-12416--CVE-2026-12417.py:321-365
Verifies administrator privileges by accessing /wp-admin/users.php and checking for admin-specific HTML markers.CVE-2026-12416--CVE-2026-12417.py:368-389
Saves confirmed admin credentials (URL, username, password) to scan_results/pravel_admin_success.txt.CVE-2026-12416--CVE-2026-12417.py:152-163

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior: The script sends POST requests to /wp-admin/admin-ajax.php with action=pravel_change_password or action=pravel_invoice_change_password, an empty reset_activation_code, and a hardcoded new password to reset arbitrary user accounts.This is the normal exploit behavior for the referenced CVEs and is fully documented in the README and code comments.CVE-2026-12416--CVE-2026-12417.py:186-212README.md:44-81
Hardcoded Credential: NEW_PASSWORD = "Nxploited@123KSa"The password set on compromised accounts is hardcoded and used for subsequent login verification. This is part of the exploit workflow, not a backdoor.CVE-2026-12416--CVE-2026-12417.py:34
Result Exfiltration: Successful admin credentials are saved to scan_results/pravel_admin_success.txt.This is the intended output of the scanner and is disclosed in the README. It does not represent covert exfiltration.CVE-2026-12416--CVE-2026-12417.py:152-163README.md:95-99

Review boundaries

What the analysis did not establish

One file (likely .gitignore or similar) was omitted from text content; its metadata shows 1505 bytes and is not expected to alter classification.
Evidence coverage is complete for the two provided text files; no other files were identified as relevant.
One file (1505 bytes) was present in the repository but classified as unclassified and was not provided as text; its content is unknown.
Binary analysis was not performed; the review is limited to the supplied readable text files.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubxxconi/CVE-2026-12415-or-CVE-2026-12416.pyRepository PoCby xxconi0Stub2 files

104 B · linked to 2 vulnerabilities

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

The artifact is a placeholder repository containing only a README and an empty Python file. The Python file contains a single comment line stating 'fixed version updated waiting', and the README merely repeats the filename. No exploit, scanner, or substantive technical analysis code is present.

Backdoor review

No backdoor observed in reviewed code

The repository contains only a placeholder Python file and a README. The Python file holds a single line of text ('fixed version updated waiting') and the README repeats the filename. No executable code, network calls, persistence mechanisms, or deceptive behavior is present. The content is inert and does not perform any actions.

ClassificationStub

Model confidence100%

AuthenticationUnknown

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains no functional code. The sole Python file is a stub with a single comment, and the README provides no technical content. This is a materially incomplete artifact.

CVE-2026-12415-or-CVE-2026-12416.py:1README.md:1-2

Observed behavior

The Python file contains only a comment: 'fixed version updated waiting'.CVE-2026-12415-or-CVE-2026-12416.py:1

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Content: fixed version updated waitingThe sole Python file contains only a status message, not executable exploit or backdoor code.CVE-2026-12415-or-CVE-2026-12416.py:1
File Content: # CVE-2026-12415-or-CVE-2026-12416.pyThe README contains only a comment with the filename, providing no instructions or payload.README.md:1-2

Review boundaries

What the analysis did not establish

The evidence packet reports complete_artifact_coverage, but the only Python file contains a single comment and no executable code.
Only the two text files in the repository were reviewed; no other files exist in the snapshot.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2026-12416

plugins.trac.wordpress.org

https://plugins.trac.wordpress.org/browser/invoice-creator/tags/1.0.0/lib/user-manage-function.php

wordfence.com

https://www.wordfence.com/threat-intel/vulnerabilities/id/cc0fbe84-e455-4e62-9c48-49340d08f81d?source=cve