The Moloni WordPress plugin before version 5.0.14 fails to enforce capability or nonce checks on several authenticated AJAX actions. This oversight allows any authenticated user, including those with the lowest subscriber role, to generate fiscal invoices for arbitrary orders, discard orders, and create or modify products and their stock. The result is unauthorized control over financial records and inventory data.

WordPress sites that have installed the Moloni plugin with a version earlier than 5.0.14 are affected. The vulnerability operates regardless of other settings or user configurations on the site.

Exploitation requires only a valid authenticated WordPress account and standard AJAX requests; no additional privileges are needed beyond the baseline account. The CVSS score of 6.5 marks it as moderate severity, and the EPSS score of < 1% indicates a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but the absence of proper capability checks still provides a clear vector for privilege escalation and unauthorized manipulation of invoicing data.