CVE-2026-106932
CVE-2026-106932 · Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.
CVSS 6.5 · Moyenne · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
moloni
- Versions du logiciel
- ≥ 0, < 5.0.14: Concernée (semver)
Mettez à jour vers 5.0.14