CVE-2026-12417

CRITICAL

SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-12417 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC.

Description

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via `wp_ajax_nopriv_pravel_change_password` and therefore accessible to unauthenticated users — performing no nonce verification, no capability check, and only a loose equality check between an attacker-supplied `reset_activation_code` POST parameter and the target user's `forgot_email` user meta value; when a user has never initiated a password reset, `get_user_meta()` returns an empty string that trivially satisfies this check against an omitted or empty attacker-supplied code. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by sending a crafted POST request to `admin-ajax.php` with `action=pravel_change_password`, `reset_user_id` set to the target account's user ID, and `new_password_custom` set to an attacker-chosen password. Successful exploitation allows the attacker to authenticate with the newly set password and fully take over the targeted account, achieving administrator-level privilege escalation on the affected site.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 29, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

SignUp & SignIn

Browse pravel / SignUp & SignIn

Default status: unaffected

CVE ListThrough 1.0.0affected

Proofs of concept

1

Repository PoCs

GitHubNxploited/CVE-2026-12416-CVE-2026-12417Repository PoCby Nxploited2Exploit3 files

23.3 KiB · linked to 2 vulnerabilities

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that performs unauthenticated password reset on WordPress sites via vulnerable AJAX handlers (CVE-2026-12416, CVE-2026-12417), then attempts to log in and verify administrator access, saving confirmed credentials.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python mass-exploitation scanner and a README that describe and implement unauthenticated password-reset attacks against two known WordPress plugin vulnerabilities (CVE-2026-12416 and CVE-2026-12417). The code performs exactly the advertised exploit behavior: sending crafted AJAX requests to reset passwords, attempting login, verifying admin access, and saving results. No concealed backdoor, unrelated payload, persistence mechanism, or operator-directed harm beyond the stated exploit is present in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareWordPressSignUp & SignIn pluginInvoice Generator plugin
Attack typesAccount TakeoverAuthentication BypassPrivilege Escalation
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively changes user passwords on remote targets (line 186-212) and then uses the new credentials to authenticate and verify admin access (line 321-389). This goes beyond detection or scanning; it exercises the vulnerability to achieve account takeover, which is the definition of an exploit.

CVE-2026-12416--CVE-2026-12417.py:186-212CVE-2026-12416--CVE-2026-12417.py:321-389

Requirements

  • Target WordPress site must have vulnerable SignUp & SignIn or Invoice Generator plugin (<=1.0.0) installed and accessible.README.md:14-38
  • Attacker must supply a list of target URLs in a file.CVE-2026-12416--CVE-2026-12417.py:456-457

Observed behavior

  • Sends POST request to /wp-admin/admin-ajax.php with action=pravel_change_password or pravel_invoice_change_password, an empty reset_activation_code, and attacker-chosen new_password_custom to reset a user's password.CVE-2026-12416--CVE-2026-12417.py:186-212
  • After a successful password reset, enumerates usernames via REST API and author redirects, then attempts to log in to /wp-login.php with the new password.CVE-2026-12416--CVE-2026-12417.py:280-305CVE-2026-12416--CVE-2026-12417.py:321-365
  • Verifies administrator privileges by accessing /wp-admin/users.php and checking for admin-specific HTML markers.CVE-2026-12416--CVE-2026-12417.py:368-389
  • Saves confirmed admin credentials (URL, username, password) to scan_results/pravel_admin_success.txt.CVE-2026-12416--CVE-2026-12417.py:152-163
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script sends POST requests to /wp-admin/admin-ajax.php with action=pravel_change_password or action=pravel_invoice_change_password, an empty reset_activation_code, and a hardcoded new password to reset arbitrary user accounts.This is the normal exploit behavior for the referenced CVEs and is fully documented in the README and code comments.CVE-2026-12416--CVE-2026-12417.py:186-212README.md:44-81
Hardcoded Credential
NEW_PASSWORD = "Nxploited@123KSa"The password set on compromised accounts is hardcoded and used for subsequent login verification. This is part of the exploit workflow, not a backdoor.CVE-2026-12416--CVE-2026-12417.py:34
Result Exfiltration
Successful admin credentials are saved to scan_results/pravel_admin_success.txt.This is the intended output of the scanner and is disclosed in the README. It does not represent covert exfiltration.CVE-2026-12416--CVE-2026-12417.py:152-163README.md:95-99
Review boundaries

What the analysis did not establish

  • One file (likely .gitignore or similar) was omitted from text content; its metadata shows 1505 bytes and is not expected to alter classification.
  • Evidence coverage is complete for the two provided text files; no other files were identified as relevant.
  • One file (1505 bytes) was present in the repository but classified as unclassified and was not provided as text; its content is unknown.
  • Binary analysis was not performed; the review is limited to the supplied readable text files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3