Moloni
Monthly
Authenticated Subscriber-level users can abuse Moloni WordPress plugin versions before 5.0.14 to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock because several AJAX actions lack capability and nonce checks. Exploitation requires the site to have an active stored connection to the external Moloni invoicing provider, and publicly available exploit code exists; the CVSS 3.1 score is 6.5 (Medium) with PR:L and integrity-only impact. Sites that allow open registration or host untrusted low-privilege accounts face the highest practical exposure.
Authenticated Subscriber-level users can abuse Moloni WordPress plugin versions before 5.0.14 to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock because several AJAX actions lack capability and nonce checks. Exploitation requires the site to have an active stored connection to the external Moloni invoicing provider, and publicly available exploit code exists; the CVSS 3.1 score is 6.5 (Medium) with PR:L and integrity-only impact. Sites that allow open registration or host untrusted low-privilege accounts face the highest practical exposure.