EUVD-2026-14158
GHSA-2gqq-gpm5-r66x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to missing nonce validation in the ncff_add_plugin_page() function which handles settings updates. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request, granted they can trick a site administrator into performing an action such as clicking a link.
AnalysisAI
The Neos Connector for Fakturama WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce validation in the ncff_add_plugin_page() function, allowing unauthenticated attackers to modify plugin settings. Affected versions include all releases up to and including 0.0.14. An attacker can exploit this by tricking a site administrator into clicking a malicious link or visiting a crafted webpage, resulting in unauthorized modification of plugin configuration without the administrator's knowledge or consent.
Technical ContextAI
This vulnerability stems from inadequate CSRF protection in WordPress plugin administration pages. The root cause is classified under CWE-352 (Cross-Site Request Forgery), which occurs when a web application does not properly validate that state-changing requests originate from legitimate users. Specifically, the ncff_add_plugin_page() function in the Neos Connector for Fakturama plugin (identified by CPE cpe:2.3:a:neo2oo5:neos_connector_for_fakturama) fails to implement WordPress nonce verification mechanisms (such as wp_verify_nonce() checks) when processing settings updates. WordPress nonces are cryptographic tokens that prevent unauthorized form submissions by ensuring requests come from authenticated sessions within the same application context. The vulnerability is evident in the plugin code at lines 223 and 231 of the neosconnectorforfakturama-admin.php file, where POST data is processed without proper token validation.
RemediationAI
WordPress site administrators should immediately update the Neos Connector for Fakturama plugin to a version newer than 0.0.14, which should include nonce validation in the ncff_add_plugin_page() function. Check the WordPress plugin repository at https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/neosconnectorforfakturama-admin.php for the patched version. If a patched version is not yet available, disable the plugin until a security update is released, and consider using alternative Fakturama integration solutions. As a temporary workaround pending patch availability, administrators should restrict access to the WordPress admin panel to trusted IP ranges via .htaccess or firewall rules, enforce strong authentication mechanisms, and educate users not to click suspicious links while logged into WordPress. Additionally, implementing Content Security Policy (CSP) headers and monitoring for unauthorized plugin setting changes can provide defense-in-depth.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today