WordPress - Invoice Generator - CRITICAL - CVE-2026-12416. The Invoice Generator plugin for WordPress is susceptible to an account takeover issue through its password reset feature. This vulnerability exists in all versions up to and including 1.0.0. Specifically, the flaw arises from the `pravel_invoice_change_password()` function, which is mistakenly registered as a nopriv AJAX handler. Due to the absence of nonce verification and proper authorization checks, an unauthenticated attacker can exploit this weakness. By manipulating the `reset_user_id` POST parameter, an attacker can evade the activation code verification process, which checks if the `reset_activation_code` matches with the user's stored email. Since this check can trivially succeed for users who have never requested a password reset, attackers gain the ability to set a new password for any account, including that of administrators, leading to full account compromise.