---
id: "CVE-2026-106932"
kind: "vulnerability"
aliases: ["CVE-2026-106932"]
title: "Moloni WordPress plugin: low-privilege users can issue invoices and edit products"
severity: "medium"
cvss: 6.5
epss: 0.00228
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["moloni", "package", "self-hosted", "woocommerce", "wordpress"]
not_affected_if: ["no-moloni-connection", "plugin-not-installed", "plugin-version-5.0.14-or-later"]
published_at: "2026-10-21T06:16:46+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:49:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106932", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-106932", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Moloni WordPress plugin: low-privilege users can issue invoices and edit products

The Moloni plugin for WordPress, before version 5.0.14, skips capability and nonce checks on several authenticated AJAX actions. Any logged-in user, including a Subscriber, can generate fiscal invoices for arbitrary orders, discard orders, and create or modify products and stock.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Moloni plugin version in the WordPress admin plugins list or in `wp-content/plugins/moloni/` and see whether it is below `5.0.14`
- Review whether open customer registration is enabled, since that lets anyone obtain a Subscriber account

## Fix

- Update the Moloni plugin to `5.0.14` or later
- Until updated, restrict or disable new user registration and review accounts with edit rights on orders and products

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106932
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-106932

## From the sources

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_