Live › vulnerability › CVE-2026-106932
Go to dashboardThe Moloni plugin for WordPress, before version 5.0.14, skips capability and nonce checks on several authenticated AJAX actions. Any logged-in user, including a Subscriber, can generate fiscal invoices for arbitrary orders, discard orders, and create or modify products and stock.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Moloni WordPress plugin before 5.0.14 that also have a stored connection to the Moloni invoicing service. Any logged-in account can trigger the flaw, so sites that allow open registration or have many low-privilege users are most exposed. Sites without the plugin, or already on 5.0.14 or later, can skip it.
No product ranges from the sources yet.
wp-content/plugins/moloni/ and see whether it is below 5.0.145.0.14 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
This page as .md · .json · in your agent: get_signal("CVE-2026-106932")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.