Moloni WordPress plugin EUVD-2026-107057

Exploitation requires that the site hold an active stored connection to the external Moloni invoicing provider - the plugin gates these AJAX actions solely on the presence of that connection instead of capability or nonce checks. The attacker must also be authenticated (PR:L), but needs only a minimal account such as Subscriber, so the practical barrier is whether the site permits low-privilege account creation (open registration) or has untrusted authenticated users. Limiting factors: no exploitation is possible if the Moloni connection is not configured, if the plugin is updated to 5.0.14+, or if the site grants no low-privilege accounts to untrusted parties; no user interaction and no admin privileges are needed once an account exists.

This is a CWE-862 missing authorization flaw with a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N (base 6.5, Medium). The attack vector is network with low complexity and no user interaction, but PR:L confirms authentication is required - any logged-in account, including a low-privilege Subscriber, suffices. The impact profile is integrity-only (I:H; C:N/A:N), consistent with the described ability to forge fiscal invoices, discard orders, and create/modify products and stock without data disclosure or service outage. Publicly available exploit code exists (WPScan), which raises practical risk, but there is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of active or widespread exploitation at time of analysis - treat POC availability and active exploitation as distinct. SSVC-style reading: exploitation is 'POC', technical impact is partial (integrity only), and automatability is plausible given AV:N/AC:L/UI:N but constrained by the authentication requirement on sites that allow open registration. Net: a genuine priority for WordPress sites running this plugin that permit self-registration or have many low-trust accounts, but a lower real-world concern where account creation is restricted; the low-privilege-but-authenticated gate and integrity-only impact keep this below critical.

On a WordPress site running Moloni before 5.0.14 that has an active stored connection to the Moloni invoicing provider, an attacker registers or uses any low-privilege account (e.g., Subscriber) and directly invokes the unprotected authenticated AJAX actions. Because the plugin checks only for the stored provider connection rather than user capability or a nonce, the attacker can generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock. Public exploit code is available via WPScan, lowering the effort required.