CVE-2023-6966

The Moneytizer WordPress plugin (The Moneytizer) is vulnerable in versions up to 9.5.20 due to a missing capability check in core_ajax.php across multiple AJAX functions. This allows authenticated users with subscriber privileges and higher to view/update billing and bank details, adjust plugin s...

CVE-2023-6968

CVE-2023-6968 (The Moneytizer WordPress plugin): The vulnerability is a CSRF in all versions ≤ 9.6.3 caused by missing nonce validation on multiple AJAX actions. Exploitation requires a user to click a crafted link, enabling unauthenticated attackers to update and retrieve billing/bank details, p...