CVE-2026-14289
A flaw in the FacturaONE para WooCommerce plugin for WordPress allows attackers to write files to the web server without authentication. Because the plugin’s request handler is not protected, an attacker can upload malicious code and run it on the site. The vulnerability is critical and can be exploited remotely.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites that use the FacturaONE para WooCommerce plugin with VeriFactu before version 5.37. Site owners who have not upgraded the plugin are at risk.
Real-world impact
An attacker can place any file, such as a web shell, into a publicly accessible folder and then execute it, giving full control over the affected WordPress site.
Why this severity
The CVSS score of 9 reflects that the flaw can be exploited over the network, requires no user interaction, and gives the attacker full confidentiality, integrity, and availability compromise. The attack complexity is high because the plugin’s default configuration leaves a cryptographic key empty, but once that condition is met the attacker can execute arbitrary code.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources