Moloni, CVE-2026-106932

CVE, Research URL: CVE-2026-106932
Home page URL: Security reports for Moloni
Application: Moloni
Published on: Oct 21, 2026
Research Description: The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
Affected versions: max 5.0.14.
Status: vulnerable