What is the CVSS score of CVE-2026-4143?

CVE-2026-4143 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4143?

Organizations using for WordPress is vulnerable to Cross-Site Request Forgery in all should be aware of moderate risk from CVE-2026-4143, a cross-site request forgery vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-4143?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Cross-Site Request Forgery in and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

WordPress CVE-2026-4143

EUVD-2026-14158 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-21 Wordfence

GHSA-2gqq-gpm5-r66x

WordPress CSRF

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14158

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

MEDIUM 4.3

DescriptionCVE.org

The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to missing nonce validation in the ncff_add_plugin_page() function which handles settings updates. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.

AnalysisAI

The Neos Connector for Fakturama WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation in the ncff_add_plugin_page() function, allowing unauthenticated attackers to modify plugin settings. Affected versions include all releases up to and including 0.0.14. An attacker can exploit this by tricking a site administrator into clicking a malicious link or visiting a crafted webpage, resulting in unauthorized modification of plugin configuration without the administrator's knowledge or consent.

Technical ContextAI

This vulnerability stems from inadequate CSRF protection in WordPress plugin administration pages. The root cause is classified under CWE-352 (Cross-Site Request Forgery), which occurs when a web application does not properly validate that state-changing requests originate from legitimate users. Specifically, the ncff_add_plugin_page() function in the Neos Connector for Fakturama plugin (identified by CPE cpe:2.3:a:neo2oo5:neos_connector_for_fakturama) fails to implement WordPress nonce verification mechanisms (such as wp_verify_nonce() checks) when processing settings updates. WordPress nonces are cryptographic tokens that prevent unauthorized form submissions by ensuring requests come from authenticated sessions within the same application context. The vulnerability is evident in the plugin code at lines 223 and 231 of the neosconnectorforfakturama-admin.php file, where POST data is processed without proper token validation.

RemediationAI

WordPress site administrators should immediately update the Neos Connector for Fakturama plugin to a version newer than 0.0.14, which should include nonce validation in the ncff_add_plugin_page() function. Check the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/neosconnectorforfakturama-admin.php for the patched version. If a patched version is not yet available, disable the plugin until a security update is released, and consider using alternative Fakturama integration solutions. As a temporary workaround pending patch availability, administrators should restrict access to the WordPress admin panel to trusted IP ranges via .htaccess or firewall rules, enforce strong authentication mechanisms, and educate users not to click suspicious links while logged into WordPress. Additionally, implementing Content Security Policy (CSP) headers and monitoring for unauthorized plugin setting changes can provide defense-in-depth.