CVE-2026-12415: Invoice Generator <= 1.0.0 - Unauthenticated Privilege Escalation via Account Takeover via 'user_id' Parameter

Synopsis

This is a privilege escalation via account takeover in the Invoice Generator plugin for WordPress (versions up to and including 1.0.0). The vulnerability is reachable over the network with no authentication required: an unauthenticated attacker sends a crafted POST request to the exposed AJAX endpoint, supplying an arbitrary user_id and a replacement email address, which the plugin passes directly to wp_update_user() without any capability check, ownership verification, or nonce validation. Successful exploitation lets the attacker change any user's email address, including site administrators, then trigger WordPress's built-in password reset flow to fully take over the targeted account. No fix version has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation.

• AuthenticationNot required

  The handler is registered under wp_ajax_nopriv, meaning no account or session of any kind is needed to invoke it.

• Victim interactionNot required

  The attacker acts entirely on their own; no victim needs to click a link or take any action for the account takeover to succeed.

• Attack complexityDetail

  Exploitation is reliable and condition-free: the attacker supplies two POST parameters and the plugin performs the update unconditionally, with no race condition or environmental dependency.

Blast Radius

• The attacker replaces the email address of any WordPress user, including administrators, giving them control over that account's password reset flow.
• Full administrative access to the WordPress site becomes available, including the ability to install plugins, modify themes, and alter site content.
• All data accessible to the hijacked account, such as stored customer records, invoice data, and credentials saved in the WordPress database, is exposed to the attacker.
• The attacker can modify or delete site content, create new administrator accounts, and persist access even after the original account owner notices and changes their password.