Wordfence Advisory: Invoice Generator Unauth Privilege Escalation via Account Takeover CVE-2026-12415

Vulnerability Overview Vulnerability Name: Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter CVE ID: CVE-2026-12415 CVSS Score: 9.8 (Critical) Published Date: June 26, 2026 Last Updated: June 27, 2026 Researcher: Alyudin Nafie Scope of Impact Software Type: Plugin Software Name: Invoice Generator Affected Versions: <= 1.0.0 Software Source: invoice-creator Remediation Patch Status: No known patch available Recommended Actions: Please review the vulnerability details in depth and implement mitigation measures based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek alternatives. Vulnerability Description The Invoice Generator plugin contains an unauthenticated privilege escalation vulnerability due to missing capability checks for the AJAX action. This action accepts attacker-controlled and parameters and calls without verifying authentication, ownership, or validating for empty/null values. This allows an attacker to change the email address of any user, including administrators, thereby triggering WordPress's password reset process to gain access to the target account. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Sharing Options Facebook X (Twitter) LinkedIn Email Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Customer Support: 24/7 support with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Disclaimer Disclaimer: The content of this page is protected by copyright and may not be copied, modified, or distributed without permission. Contact Information Contact Email: support@wordfence.com Other Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Facebook: Facebook Twitter: Twitter Instagram: Instagram Products & Services Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support: - Documentation - Learning Center - Free Support - Premium Support News: - Blog - In The News - Vulnerability Advisories About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscribe to Updates Subscribe: Sign up for news and updates Other Powered by: Wordfence --- Note: The above information is compiled based on the provided webpage screenshot content. For specific details, please refer to the official documentation.

Goal Reached Thanks to every supporter — we hit 100%!

Wordfence Advisory: Invoice Generator Unauth Privilege Escalation via Account Takeover CVE-2026-12415

More from this source