Cross-Site Request Forgery Vulnerability in Facturación Electrónica Costa Rica Plugin for WordPress

CVE-2026-9720

What is CVE-2026-9720?

The Facturación Electrónica Costa Rica plugin for WordPress suffers from a Cross-Site Request Forgery vulnerability due to improper nonce validation. This flaw affects all versions up to and including 2.0.2, allowing attackers to manipulate the plugin's settings without authentication. By sending a forged request, an attacker could potentially alter critical configurations such as API tokens, access tokens, invoicing flags, and more, if an administrator inadvertently clicks a malicious link. This vulnerability highlights the importance of proper nonce validation mechanisms to secure WordPress plugins against unauthorized configuration changes.

References