{"api_version":"1","generated_at":"2026-04-23T06:20:54+00:00","cve":"CVE-2023-6966","urls":{"html":"https://cve.report/CVE-2023-6966","api":"https://cve.report/api/cve/CVE-2023-6966.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-6966","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-6966"},"summary":{"title":"The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions","description":"The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.","state":"PUBLISHED","assigner":"Wordfence","published_at":"2024-06-06 02:15:52","updated_at":"2026-04-08 18:18:45"},"problem_types":["CWE-284","CWE-862","CWE-284 CWE-284 Improper Access Control"],"metrics":[{"version":"3.1","source":"security@wordfence.com","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://plugins.trac.wordpress.org/changeset/3099347/the-moneytizer/trunk/core/core_ajax.php?old=3038641&old_path=the-moneytizer%2Ftrunk%2Fcore%2Fcore_ajax.php","name":"https://plugins.trac.wordpress.org/changeset/3099347/the-moneytizer/trunk/core/core_ajax.php?old=3038641&old_path=the-moneytizer%2Ftrunk%2Fcore%2Fcore_ajax.php","refsource":"security@wordfence.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve","name":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php","name":"https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6966","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6966","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"lvaudore","product":"The Moneytizer","version":"affected 9.6.3 semver","platforms":[]}],"timeline":[{"source":"CNA","time":"2024-06-05T00:00:00.000Z","lang":"en","value":"Disclosed"}],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Francesco Carlucci","lang":"en"}],"nvd_cpes":[{"cve_year":"2023","cve_id":"6966","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"themoneytizer","cpe5":"the_moneytizer","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2023-6966","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-06-07T19:28:07.509571Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-06-07T19:28:17.163Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2024-08-02T08:50:06.854Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_transferred"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve"},{"tags":["x_transferred"],"url":"https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"The Moneytizer","vendor":"lvaudore","versions":[{"lessThanOrEqual":"9.6.3","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Francesco Carlucci"}],"descriptions":[{"lang":"en","value":"The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions."}],"metrics":[{"cvssV3_1":{"baseScore":8.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-08T17:00:34.411Z","orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence"},"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71823e36-3899-4253-a1d2-c6f8921d18dc?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/the-moneytizer/trunk/core/core_ajax.php"},{"url":"https://plugins.trac.wordpress.org/changeset/3099347/the-moneytizer/trunk/core/core_ajax.php?old=3038641&old_path=the-moneytizer%2Ftrunk%2Fcore%2Fcore_ajax.php"}],"timeline":[{"lang":"en","time":"2024-06-05T00:00:00.000Z","value":"Disclosed"}],"title":"The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actions"}},"cveMetadata":{"assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","assignerShortName":"Wordfence","cveId":"CVE-2023-6966","datePublished":"2024-06-06T02:02:58.810Z","dateReserved":"2023-12-19T21:26:17.585Z","dateUpdated":"2026-04-08T17:00:34.411Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-06-06 02:15:52","lastModifiedDate":"2026-04-08 18:18:45","problem_types":["CWE-284","CWE-862","CWE-284 CWE-284 Improper Access Control"],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":5.2}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:themoneytizer:the_moneytizer:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"10.0.1","matchCriteriaId":"80061CEE-BA8D-4D0D-9105-80A52D957F76"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"6966","Ordinal":"1","Title":"The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJA","CVE":"CVE-2023-6966","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"6966","Ordinal":"1","NoteData":"The The Moneytizer plugin for WordPress is vulnerable to unauthorized access of data, modification of data, and loss of data due to a missing capability check on multiple AJAX functions in the /core/core_ajax.php file in all versions up to, and including, 9.6.3. This makes it possible for authenticated attackers, with subscriber access and above, to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions.","Type":"Description","Title":"The Moneytizer <= 9.6.3 - Missing Authorization via multiple AJA"}]}}}