Authenticated AJAX Vulnerability in Moloni WordPress Plugin
CVE-2026-106932
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-106932?
The Moloni WordPress plugin prior to version 5.0.14 exhibits a critical security flaw where it fails to perform necessary capability or nonce validations on several authenticated AJAX actions. This oversight permits any authenticated user, including those with lower privileges such as Subscribers, to execute inappropriate actions. Such unauthorized actions include the ability to generate fiscal invoices for any orders, discard arbitrary orders, and create or modify products and stock levels without proper authorization.
Affected Version(s)
Moloni 0 < 5.0.14
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.