Multiple vulnerabilities affecting WordPress plugins

Invoice Generator is a WordPress plugin for creating and managing invoices. SignUp & SignIn, for its part, is a WordPress extension that simplifies user registration, authentication and profile management. These solutions are affected by several vulnerabilities labeled as follows: CVE-2026-12416: This vulnerability arises from an authorization and validation check failure when calling the "pravel_invoice_change_password()" function in the Invoice Generator extension. Exploitation of this vulnerability would allow an unauthenticated malicious actor to reset and change the password of any user, including administrators, leading to complete account takeover. This vulnerability is classified critical with a severity score of 9.8 according to CVSS v3.1. CVE-2026-12417: This vulnerability is due to weak and insufficient validation during the password reset process (via the "reset_activation_code" parameter) within the SignUp & SignIn extension. It would allow an unauthenticated malicious actor to elevate privileges and take control of target accounts. This vulnerability is classified critical with a severity score of 9.8 according to CVSS v3.1.

• Invoice Generator extension versions less than or equal to 1.0.0;
• Versions of the SignUp & SignIn extension less than or equal to 1.0.0;