CVE-2026-106932 Overview
CVE-2026-106932 affects the Moloni WordPress plugin in versions before 5.0.14. The plugin exposes several authenticated AJAX actions without capability or nonce checks. Instead, it only verifies that the site holds a stored connection to its external invoicing provider. Any authenticated user, including a Subscriber, can abuse these endpoints to generate fiscal invoices for arbitrary orders, discard arbitrary orders, and create or modify products and stock. The flaw maps to CWE-862: Missing Authorization.
Critical Impact
Low-privileged authenticated users can issue fiscal invoices, destroy orders, and tamper with product catalogs and stock levels on affected stores.
Affected Products
- Moloni WordPress plugin versions prior to 5.0.14
- WordPress sites with an active Moloni invoicing connection configured
- WooCommerce stores integrated with the Moloni plugin
Discovery Timeline
- 2026-10-21 - CVE-2026-106932 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-106932
Vulnerability Analysis
The Moloni plugin registers multiple AJAX handlers available to authenticated users through wp-admin/admin-ajax.php. These handlers perform privileged e-commerce operations such as fiscal invoice issuance, order deletion, and product management. The handlers skip the standard WordPress authorization pattern of calling current_user_can() for a privileged capability and verifying a request nonce with check_ajax_referer().
Instead, the plugin treats the presence of a stored connection to the Moloni invoicing service as sufficient authorization. Any user with a valid session, including the lowest-privilege Subscriber role, satisfies this check once they authenticate to wp-admin.
The resulting impact is integrity-focused. Attackers cannot read sensitive data through these endpoints, but they can forge fiscal documents, destroy order records, and alter catalog data. Sites that permit open registration are the most exposed because an attacker only needs to create a free account.
Root Cause
The root cause is a missing authorization check [CWE-862]. The AJAX callbacks rely on a boolean state about the invoicing integration rather than per-user capability and request-origin validation. This design confuses application state with user authorization.
Attack Vector
An attacker registers or authenticates as any WordPress user on a vulnerable site. They then send crafted POST requests to the affected admin-ajax.php actions, supplying order IDs or product payloads. Because the handlers do not validate the caller's role or a nonce, the plugin executes the requested operation under the invoicing integration's authority. See the WPScan Vulnerability Report for the vulnerable action list and request shape.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-106932
Indicators of Compromise
- Fiscal invoices issued for orders that administrators did not approve or acknowledge
- Orders transitioning to a discarded or cancelled state without a legitimate admin action in the audit log
- Unexpected creation or modification of WooCommerce products, SKUs, or stock quantities
- POST requests to admin-ajax.php with Moloni-related action parameters originating from Subscriber accounts
Detection Strategies
- Review web server access logs for admin-ajax.php requests tied to Moloni actions and correlate the authenticated user ID with the user's assigned role.
- Audit WordPress user accounts created in the days preceding any suspicious invoice or order activity, especially self-registered Subscribers.
- Compare current product and stock state against known-good backups to identify unauthorized catalog mutations.
Monitoring Recommendations
- Alert on any Moloni plugin AJAX action invoked by a user whose role is not Shop Manager or Administrator.
- Monitor WooCommerce order status transitions and raise alerts on bulk order discards.
- Track invoice issuance volume and flag deviations from historical baselines.
How to Mitigate CVE-2026-106932
Immediate Actions Required
- Upgrade the Moloni plugin to version 5.0.14 or later on every WordPress site that uses it.
- Disable open user registration or restrict the default new-user role until the patch is applied.
- Audit recently issued invoices, cancelled orders, and product changes to identify unauthorized actions.
Patch Information
The vendor addressed the issue in Moloni version 5.0.14. The fix introduces capability and nonce checks on the affected AJAX handlers. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Deactivate the Moloni plugin until it can be upgraded to 5.0.14.
- Temporarily disconnect the Moloni invoicing integration, which removes the stored connection the vulnerable handlers rely on.
- Restrict access to wp-admin/admin-ajax.php for untrusted roles through a web application firewall rule targeting Moloni action names.
# Update the Moloni plugin via WP-CLI
wp plugin update moloni --version=5.0.14
# Verify the installed version
wp plugin get moloni --field=version
# Disable open registration as a temporary hardening step
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
