Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter

An unauthenticated attacker sends a POST request to `wp-admin/admin-ajax.php` with `action=pravel_invoice_change_password`, supplying a target `reset_user_id` (e.g., an administrator's ID) and a chosen `new_password_custom`. By omitting the `reset_activation_code` parameter, the attacker triggers a loose equality comparison (`'' == ''`) against the target user's `forgot_email` user meta, which is empty for users who never requested a password reset. This bypasses the activation code check entirely, allowing the attacker to set a new password and take over any account, including administrators.

The vulnerable function is `pravel_invoice_change_password()` in `lib/user-manage-function.php` (around line 296). It is registered as a `wp_ajax_nopriv_` handler with no nonce verification and no authorization check. The critical flaw is the loose equality comparison `$user_side_activation_code == $server_side_activation_code` on line 303, which evaluates to `'' == ''` for any user who has never initiated a forgot-password request.

The patch is not included in the bundle, but the advisory explains that the fix must add nonce verification and authorization checks to the `pravel_invoice_change_password()` AJAX handler, and replace the loose equality operator (`==`) with strict equality (`===`) so that an empty string from a user who never requested a password reset does not match an empty stored meta value. Additionally, the handler should verify that a valid password reset was actually initiated for the target user before allowing a password change.