Privilege Escalation in Invoice Generator WordPress Plugin

Executive Summary

The Invoice Generator plugin for WordPress has a vulnerability that allows privilege escalation because it lacks a proper capability check on the pravel_invoice_edit_account() AJAX action in versions up to and including 1.0.0.

This AJAX handler is accessible without authentication (via wp_ajax_nopriv_pravel_invoice_edit_account) and accepts user_id and user_email parameters from POST data. It then calls wp_update_user() without verifying if the requester is authenticated, owns the account, or has a valid nonce.

As a result, an unauthenticated attacker can change the email address of any user, including administrators, and subsequently trigger WordPress's password reset process to gain unauthorized access to the targeted account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows unauthenticated attackers to take over any user account by changing the email address and resetting the password.

• Unauthorized access to administrator accounts, leading to full control over the WordPress site.
• Potential data theft, site defacement, or malicious content injection.
• Disruption of website operations and loss of trust from users or customers.

Useful 0 Not Useful 0