CVE-2023-6968highCWE-284

CVE-2023-6968: high-severity vulnerability in lvaudore The Moneytizer

The Moneytizer <= 9.6.3 - Cross-Site Request Forgery via multiple AJAX actions

Published · Updated

Follow this CVE+ Monitor The Moneytizer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.2%
The The Moneytizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 9.6.3. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to to update and retrieve billing and bank details, update and reset the plugin's settings, and update languages as well as other lower-severity actions via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
lvaudore · The Moneytizer
Related CVEs — lvaudore The Moneytizer

In the same product, most dangerous first.

CVE-2023-6966HIGHThe Moneytizer <= 9.6.3 - Missing Authorization via multiple AJAX actionsEPSS 0.4%CVE-2026-39685MEDIUMWordPress The Moneytizer plugin <= 10.0.10 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-62756MEDIUMWordPress The Moneytizer plugin <= 10.0.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%