pravel SignUp & SignIn Plugin up to 1.0.0 on WordPress AJAX admin-ajax.php pravel_change_password reset_activation_code password recovery

Summaryinfo

A vulnerability, which was classified as critical, was found in pravel SignUp & SignIn Plugin up to 1.0.0 on WordPress. Affected is the function pravel_change_password of the file admin-ajax.php of the component AJAX Handler. Such manipulation of the argument reset_activation_code leads to password recovery. This vulnerability is referenced as CVE-2026-12417. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in pravel SignUp & SignIn Plugin up to 1.0.0 on WordPress. It has been rated as critical. Affected by this issue is the function pravel_change_password of the file admin-ajax.php of the component AJAX Handler. The manipulation of the argument reset_activation_code with an unknown input leads to a password recovery vulnerability. Using CWE to declare the problem leads to CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via `wp_ajax_nopriv_pravel_change_password` and therefore accessible to unauthenticated users — performing no nonce verification, no capability check, and only a loose equality check between an attacker-supplied `reset_activation_code` POST parameter and the target user's `forgot_email` user meta value; when a user has never initiated a password reset, `get_user_meta()` returns an empty string that trivially satisfies this check against an omitted or empty attacker-supplied code. This makes it possible for unauthenticated attackers to change the password of any WordPress user, including administrators, by sending a crafted POST request to `admin-ajax.php` with `action=pravel_change_password`, `reset_user_id` set to the target account's user ID, and `new_password_custom` set to an attacker-chosen password. Successful exploitation allows the attacker to authenticate with the newly set password and fully take over the targeted account, achieving administrator-level privilege escalation on the affected site.

The weakness was published by Alyudin Nafiie. The advisory is available at wordfence.com. This vulnerability is handled as CVE-2026-12417 since 06/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/24/2026). This vulnerability is assigned to T1552 by the MITRE ATT&CK project.

By approaching the search of inurl:admin-ajax.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• pravel

Name

• SignUp & SignIn Plugin

Version

• 1.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion