---
id: CVE-2026-106932
title: >-
  Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via
  genInvoice
summary: >-
  The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce
  checks on several of its authenticated AJAX actions, relying only on whether
  the site holds a stored connection to its external invoicing provider,
  allowing a…
severity: none
cwe:
  - CWE-862
product: Moloni
affected:
  - Moloni < 5.0.14
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T06:00:19.354Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106932'
references:
  - url: 'https://wpscan.com/vulnerability/d76e3e03-431b-4aec-ae11-b33ee58d28f1/'
tags:
  - cve.org
ingestedAt: '2026-10-21T06:42:48.184Z'
---

## Overview

The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user such as a Subscriber to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock.

## Affected

- `Moloni < 5.0.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.