EUVD-2026-50199
GHSA-6f8f-g768-8537
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attacker is unauthenticated (PR:N) but mandatory admin click (UI:R) is required; integrity impact is limited to plugin configuration fields only, with no confidentiality or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the (global scope, included by fvcr_admin_page_html) function. This makes it possible for unauthenticated attackers to modify the plugin's configuration, including API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Cross-Site Request Forgery in the Facturación Electrónica Costa Rica WordPress plugin (all versions through 2.0.2) allows unauthenticated attackers to overwrite critical plugin configuration - including API tokens, Hacienda environment mode, and invoice emission flags - by tricking a logged-in site administrator into clicking a malicious link. The flaw stems from missing nonce validation in the admin configuration handler exposed via fvcr_admin_page_html, confirmed by Wordfence with direct source references to admin/configuration.php and functions.php. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Facturación Electrónica Costa Rica plugin must be installed, active, and running version 2.0.2 or earlier on the target WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (Medium) correctly captures that UI:R is a genuine friction point - the attack cannot succeed without a logged-in administrator actively triggering the forged request, ruling out fully automated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a Costa Rican WordPress merchant site running the vulnerable plugin and crafts a hidden HTML form on an attacker-controlled page that submits a configuration-change POST request to the victim site's wp-admin endpoint. The attacker sends a phishing email to the merchant's administrator - posing as a Hacienda support notice or plugin update alert - containing a link to the malicious page. … |
| Remediation | The primary fix is to update the plugin to a version beyond 2.0.2 once the vendor (FacturadorVirtual) releases a patched build - no confirmed patched version is available in the current intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today