WordPress - Invoice Generator - CRITICAL - CVE-2026-12415. The Invoice Generator plugin for WordPress has a serious vulnerability that allows attackers to escalate privileges through a missing capability check in the pravel_invoice_edit_account() AJAX action. This issue occurs in versions up to and including 1.0.0. The vulnerability can be exploited by unauthenticated users by sending a specially crafted request that includes an arbitrary user_id and user_email via the wp_ajax_nopriv_pravel_invoice_edit_account. Due to the lack of necessary verifications, attackers can change the email address of any user—including administrators—leading to unauthorized access via WordPress's password reset facility.