CVE-2026-12415— pravel Invoice Generator 权限许可和访问控制问题漏洞

Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter

The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoice_edit_account, accepts an attacker-controlled user_id and user_email from POST data, and calls wp_update_user() without verifying authentication, ownership, or a nonce. This makes it possible for unauthenticated attackers to change the email address of any user, including administrators, and then trigger WordPress's password reset flow to gain access to the targeted account.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

特权管理不恰当

pravel Invoice Generator 权限许可和访问控制问题漏洞

pravel Invoice Generator是pravel个人开发者的一款发票生成软件。 pravel Invoice Generator 1.0.0及之前版本存在权限许可和访问控制问题漏洞，该漏洞源于对pravel_invoice_edit_account() AJAX操作缺少权限检查，可能导致未经身份验证的攻击者更改任何用户的电子邮件地址并重置密码获取账户访问权限。

N/A

N/A