Pravel vulnerabilities
We track 3 vulnerabilities in Pravel products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on June 27, 2026.
Latest Pravel vulnerabilities
- 9.8 Critical severity
Invoice Generator: Improper Privilege Management
The Invoice Generator plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the pravel_invoice_edit_account() AJAX action in versions up to, and including, 1.0.0. The handler is exposed via wp_ajax_nopriv_pravel_invoic
- 9.8 Critical severity
SignUp & SignIn: Weak Password Recovery Mechanism for Forgotten Password
The SignUp & SignIn plugin for WordPress is vulnerable to Authentication Bypass via Weak Password Reset Validation leading to Account Takeover in versions up to, and including, 1.0.0. This is due to the `pravel_change_password()` AJAX handler — registered via
- 9.8 Critical severity
Invoice Generator: Weak Password Recovery Mechanism for Forgotten Password
The Invoice Generator plugin for WordPress is vulnerable to Account Takeover via Password Reset in all versions up to, and including, 1.0.0. This is due to the `pravel_invoice_change_password()` function being registered as a nopriv AJAX handler with no nonce