Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
Fakturama Plugin for WordPress Allows Malicious Settings Changes
CVE-2026-4143
Summary
The Fakturama plugin for WordPress can be tricked into changing its settings by an attacker. This can happen if a site administrator clicks on a malicious link. Update to the latest version to fix the issue.
Original title
The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to missing nonce validation in the ncff_add...
Original description
The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to missing nonce validation in the ncff_add_plugin_page() function which handles settings updates. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
nvd CVSS3.1
4.3
Vulnerability type
CWE-352
Cross-Site Request Forgery (CSRF)
- https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/tags/0.0...
- https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/tags/0.0...
- https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/ne...
- https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/ne...
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ffc8de-e8e4-41b6-a4b...
Published: 21 Mar 2026 · Updated: 21 Mar 2026 · First seen: 21 Mar 2026