CVE-2026-12416Disclosure

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 4 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce verification and no authorization check, and performing a loose equality comparison between the supplied `reset_activation_code` POST parameter and the target user's stored `forgot_email` user meta — a check that trivially evaluates to true (`'' == ''`) for any user who has never initiated a forgot-password request, which applies to administrators under normal conditions. This makes it possible for unauthenticated attackers to supply an arbitrary user ID via the `reset_user_id` POST parameter, bypass the activation code check entirely by omitting `reset_activation_code`, and set the target account's password to an attacker-chosen value, enabling full takeover of any account on the site, including administrator accounts.

Back to dashboard

5.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-640

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
7 mentions across 4 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 2 signals
Technical details provided in 6 signals
Disclosure: 3 classified signals
General: 1 classified signal
Peaked 3d ago at 4 mentions (2026-06-24); latest day: 1
7 total mentions across 4 days

Deep dive

Activity timeline7 mentions / 4d

Signal classification5 categories

Disclosure

342.9%

General

114.3%

Patch

114.3%

PoC

114.3%

Exploit

114.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-24	4	Disclosure2General1Patch1
2026-06-25	1	PoC1
2026-06-27	1	Exploit1
2026-06-30	1	Disclosure1

Full discourse7 posts

ExploitGrid@exploitgrid87d
Exploit
Top CVEs w/ public exploits (Jun 20–27): CVE-2026-48908 Joomla SPB RCE (exploited live) CVE-2026-48909 Joomla SP LMS PHP Obj injection CVE-2026-12417 SignUp/In admin takeover CVE-2026-12416 Invoice Generator takeover CVE-2026-39938 Cacti LFI Protect via http://exploitgrid.net
Post summary
The post lists five CVEs from June 20–27, highlighting that they have publicly available exploits and directing readers to exploitgrid.net for details; CVE‑2026‑48908 is noted as already being exploited in the wild.
2502191.9K
33 followersView on X
DFIR Lab@DFIR_Lab91d
Disclosure
🚨 CRITICAL: CVE-2026-12416 (CVSS 9.8) Invoice Generator plugin for WordPress allows unauthenticated account takeover via password reset bypass. All versions ≤1.0.0 affected. Admin accounts at risk. Patch immediately or disable plugin. #CVE #Vulnerability #PatchNow https://t.co/ovTAzJzppp
Post summary
The tweet announces the newly disclosed WordPress plugin vulnerability CVE-2026-12416, highlighting its critical severity and urging immediate patching or disabling of the plugin.
0201155
50 followersView on X
Upwind Security MDR@UpwindMDR91d
Disclosure
🚨 CRITICAL - Unauthenticated account takeover via password reset bypass (CVE-2026-12416) CVE-2026-12416 is an account takeover flaw in the Invoice Generator plugin for WordPress, specifically in its password reset functionality. The root cause is missing nonce/authorization checks combined with a loose equality comparison that incorrectly passes activation-code validation when no reset code exists. An unauthenticated attacker can exploit this remotely by calling the reset flow and supplying a target user ID to set a new password without possessing a valid reset code. Successful exploitation enables full takeover of arbitrary user accounts, including administrators, leading to complete site compromise. 👉 Affected: Invoice Generator plugin for WordPress <= 1.0.0 | Upgrade to No fix yet - treat as suspicious
Post summary
The post discloses a critical unauthenticated account takeover flaw in the Invoice Generator WordPress plugin, explaining how the missing nonce and loose equality checks allow password reset bypass, but notes that no patch is currently available.
01010100
226 followersView on X
Orizon@OrizonCyber91d
Patch
🚨 CVE-2026-12416 — CVSS 9.8/10 ██████████ The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to,... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/zq2wRBrltG
Post summary
The tweet announces a critical WordPress plugin vulnerability (CVE-2026-12416) with an available patch and provides key technical details.
1000073
59 followersView on X
SecAlerts@SecAlertsCo84d
Disclosure
CVE-2026-12416: Pravel Invoice Generator plugin (≤1.0.0) for WordPress has a CVSS 9.8 unauthenticated account takeover. Weak 'reset_user_id' validation lets attackers hijack any account remotely. 🔑 #WordPress #infosec https://secalerts.co/vulnerability/CVE-2026-12416?utm_campaign=x https://t.co/f8FW9tai24
Post summary
The post announces a severe CVE (9.8) affecting the Pravel Invoice Generator plugin, highlighting an unauthenticated account takeover via weak reset_user_id validation.
0000075
847 followersView on X
Atomic Edge@atomicedgeWAF90d
PoC
https://atomicedge.io/cve-proof/cve-2026-12416-invoice-creator-version-1-0-0-critical-vulnerability-proof-of-concept CVE-2026-12416 invoice-creator (CVSS Score 9.8) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atom…
Post summary
A proof‑of‑concept for CVE‑2026‑12416 in the Invoice Creator WordPress plugin is presented, noting its critical CVSS score, but no exploits, patches, or evidence of active exploitation are provided.
0000062
11 followersView on X
ThreatAft@ThreatAft90d
General
🔐 WordPress Invoice Generator Plugin Flaw Allows Account Takeover A critical vulnerability in the Invoice Generator plugin for WordPress, tracked as CVE-2026-12416. 🔗 https://threataft.com/articles/wordpress-invoice-generator-account-takeover-cve-2026-12416 #CyberSecurity #ThreatIntel
Post summary
A critical vulnerability (CVE‑2026‑12416) in the WordPress Invoice Generator plugin is announced as a potential account takeover risk, but no exploitation details or patches are provided.
0000054
31 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-12416

DFIR Lab[verified]@DFIR_LabDisclosure

The tweet announces the newly disclosed WordPress plugin vulnerability CVE-2026-12416, highlighting its critical severity and urging immediate patching or disabling of the plugin.

Upwind Security MDR[verified]@UpwindMDRDisclosure

The post discloses a critical unauthenticated account takeover flaw in the Invoice Generator WordPress plugin, explaining how the missing nonce and loose equality checks allow password reset bypass, but notes that no patch is currently available.

Orizon[verified]@OrizonCyberPatch

The tweet announces a critical WordPress plugin vulnerability (CVE-2026-12416) with an available patch and provides key technical details.

ExploitGrid@exploitgridExploit

The post lists five CVEs from June 20–27, highlighting that they have publicly available exploits and directing readers to exploitgrid.net for details; CVE‑2026‑48908 is noted as already being exploited in the wild.

SecAlerts@SecAlertsCoDisclosure

The post announces a severe CVE (9.8) affecting the Pravel Invoice Generator plugin, highlighting an unauthenticated account takeover via weak reset_user_id validation.

Atomic Edge@atomicedgeWAFPoC

A proof‑of‑concept for CVE‑2026‑12416 in the Invoice Creator WordPress plugin is presented, noting its critical CVSS score, but no exploits, patches, or evidence of active exploitation are provided.

ThreatAft@ThreatAftGeneral

A critical vulnerability (CVE‑2026‑12416) in the WordPress Invoice Generator plugin is announced as a potential account takeover risk, but no exploitation details or patches are provided.