CVE-2026-106932: CWE-862 Missing Authorization in Moloni

CVE-2026-106932 is a missing authorization vulnerability (CWE-862) in the Moloni WordPress plugin prior to version 5.0.14. The plugin fails to verify user capabilities or nonce tokens on multiple authenticated AJAX endpoints, instead only checking if the site has a stored connection to the external invoicing service. This insufficient authorization allows any authenticated user, regardless of role, to perform privileged actions such as generating invoices for arbitrary orders, discarding orders, and modifying product and stock data.

An attacker with any authenticated user account, including low-privilege roles like Subscriber, can abuse the plugin's AJAX actions to generate fiscal invoices for orders they should not control, discard arbitrary orders, and create or modify products and stock. This can lead to unauthorized financial document creation and manipulation of e-commerce data, potentially causing financial discrepancies and operational disruption.

Upgrade the Moloni WordPress plugin to version 5.0.14 or later where this authorization issue is fixed. Until then, restrict authenticated user roles to trusted users only and consider disabling the plugin if possible. Patch status is not explicitly stated but the presence of a fixed version 5.0.14 indicates an official fix is available.