{"id":"CVE-2026-106932","kind":"vulnerability","aliases":["CVE-2026-106932"],"related":[],"title":"Moloni WordPress plugin: low-privilege users can issue invoices and edit products","description":"The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.","summary":"The Moloni plugin for WordPress, before version 5.0.14, skips capability and nonce checks on several authenticated AJAX actions. Any logged-in user, including a Subscriber, can generate fiscal invoices for arbitrary orders, discard orders, and create or modify products and stock.","severity":"medium","cvss":6.5,"epss":0.00228,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["moloni","package","self-hosted","woocommerce","wordpress"],"not_affected_if":["no-moloni-connection","plugin-not-installed","plugin-version-5.0.14-or-later"],"how_to_check":"- Check the installed Moloni plugin version in the WordPress admin plugins list or in `wp-content/plugins/moloni/` and see whether it is below `5.0.14`\n- Review whether open customer registration is enabled, since that lets anyone obtain a Subscriber account","fix":"- Update the Moloni plugin to `5.0.14` or later\n- Until updated, restrict or disable new user registration and review accounts with edit rights on orders and products","status":"open","published_at":"2026-10-21T06:16:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:49:09+00:00","updated_at":"2026-10-25T03:49:09+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:49:09Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Moloni plugin to `5.0.14` or later\n- Until updated, restrict or disable new user registration and review accounts with edit rights on orders and products","reach":"internet","title":"Moloni WordPress plugin: low-privilege users can issue invoices and edit products","impact":"medium","summary":"The Moloni plugin for WordPress, before version 5.0.14, skips capability and nonce checks on several authenticated AJAX actions. Any logged-in user, including a Subscriber, can generate fiscal invoices for arbitrary orders, discard orders, and create or modify products and stock.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","moloni","self-hosted"],"confidence":0.8,"needs_auth":"yes","worst_case":"Any logged-in user alters orders, products and stock and issues fiscal invoices","analyst_note":"","how_to_check":"- Check the installed Moloni plugin version in the WordPress admin plugins list or in `wp-content/plugins/moloni/` and see whether it is below `5.0.14`\n- Review whether open customer registration is enabled, since that lets anyone obtain a Subscriber account","needs_analyst":false,"not_affected_if":["plugin-version-5.0.14-or-later","plugin-not-installed","no-moloni-connection"],"who_is_affected":"Sites running the Moloni WordPress plugin before 5.0.14 that also have a stored connection to the Moloni invoicing service. Any logged-in account can trigger the flaw, so sites that allow open registration or have many low-privilege users are most exposed. Sites without the plugin, or already on 5.0.14 or later, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3385,"output_tokens":619,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106932':16A,19A '-2026':15A,18A '5.0.14':34B,74C 'action':44B,88C 'ajax':43B,87C 'allow':104C 'arbitrari':58B,117C,120C 'authent':42B,86C,106C 'capabl':36B,78C 'check':39B,81C 'connect':98C 'creat':63B,123C 'cve':14A,17A 'discard':60B,119C 'edit':12A 'extern':101C 'fiscal':55B,114C 'generat':54B,113C 'hold':95C 'host':24B 'includ':50B 'invoic':10A,56B,102C,115C 'issu':9A 'log':47B 'logged-in':46B 'low':5A 'low-privileg':4A 'modifi':65B,125C 'moloni':1A,20B,28B,70C 'nonc':38B,80C 'order':59B,61B,118C,121C 'packag':21B 'perform':77C 'plugin':3A,29B,72C 'privileg':6A 'product':13A,66B,126C 'provid':103C 'reli':89C 'self':23B 'self-host':22B 'sever':41B,83C 'site':94C 'skip':35B 'stock':68B,128C 'store':97C 'subscrib':52B,111C 'user':7A,49B,107C 'version':33B 'whether':92C 'woocommerc':25B 'wordpress':2A,26B,31B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Moloni WordPress plugin before 5.0.14 that also have a stored connection to the Moloni invoicing service. Any logged-in account can trigger the flaw, so sites that allow open registration or have many low-privilege users are most exposed. Sites without the plugin, or already on 5.0.14 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106932","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106932","severity":null,"published_at":"2026-10-21T06:16:46+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-106932","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106932","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}