CVE-2026-12416: Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter

Synopsis

This is an authentication bypass and account takeover vulnerability in the Invoice Generator plugin for WordPress, versions 1.0.0 and below. The flaw is reachable over the network with no credentials required: the plugin registers a password-reset function as a public AJAX handler, performs a loose equality check on an activation code that is empty by default for most users (including administrators), and accepts an arbitrary user ID supplied by the attacker. A successful exploit lets an unauthenticated attacker set the password of any WordPress account to a value they choose, giving them full control of that account. No fix version has been published; HarborGuard tracks the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable AJAX endpoint is exposed over the network via the WordPress wp-admin/admin-ajax.php interface, so an attacker must be able to reach the target site over the internet or an accessible network.

• AuthenticationNot required

  The handler is registered as a nopriv AJAX action, meaning no WordPress account or session of any kind is needed to invoke it.

• Victim interactionNot required

  The attacker sends a crafted POST request directly to the server; no action from any user or administrator is required.

• Attack complexityDetail

  The exploit is reliable and condition-free: the activation code check trivially passes for any user who has never requested a password reset (which covers administrators under normal conditions), requiring only knowledge of a numeric user ID.

Blast Radius

• The attacker gains the ability to set the password of any WordPress account, including administrator accounts, to an attacker-chosen value, achieving full account takeover.
• With administrator access, the attacker can read all site content, stored user data, payment records, and any invoice data managed by the plugin.
• An attacker with administrator access can modify or delete site content, install or alter plugins and themes, and change site configuration.
• Full WordPress administrator control enables the attacker to render the site unavailable by disabling it, corrupting the database, or removing critical content.