What’s Vulnerable › Vulnerabilities

CVE-2023-6966: The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-06 · updated 2026-06-17
• Weakness: CWE-284

Description

The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.

Affected products

• lvaudore The Moneytizer: before 10.0.1 — fixed in 10.0.1

How to fix

Upgrade to a fixed version: lvaudore The Moneytizer 10.0.1. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php
• https://plugins.trac.wordpress.org/changeset/3099347/the-moneytizer/trunk/core/core_ajax.php?old=3038641&old_path=the-moneytizer%2Ftrunk%2Fcore%2Fcore_ajax.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve
• https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve

Get alerted when CVE-2023-6966 or the next vulnerability affects your stack