CVE-2026-106932

Deferred Deferred - Pending Action

Authenticated AJAX Actions in Moloni WordPress Plugin Allow Arbitrary Order and Product Manipulation

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-106932

EUVD

EUVD-2026-107057

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Moloni	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Moloni WordPress plugin before version 5.0.14 lacks proper authorization checks on certain AJAX actions. This allows any authenticated user, even with minimal Subscriber privileges, to perform actions like generating invoices, discarding orders, and modifying products or stock without valid permissions.

Detection Guidance

Check the installed version of the Moloni WordPress plugin. If it is below 5.0.14, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

An attacker with Subscriber access could manipulate orders, create fake invoices, or alter product details and inventory. This could lead to financial losses, incorrect billing, or disruption of business operations.

Compliance Impact

This vulnerability could lead to unauthorized creation or modification of financial records, which may violate compliance requirements under GDPR (data integrity) and HIPAA (record-keeping integrity). Unauthorized invoice generation or order discarding could result in inaccurate financial reporting, potentially breaching regulatory standards.

Mitigation Strategies

Update the Moloni plugin to version 5.0.14 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-106932. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...