CVE-2026-9720

Name of the Vulnerable Software and Affected Versions Facturación Electrónica Costa Rica versions prior to 2.0.3

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or incorrect nonce validation within the (global scope, included by fvcr admin page html) function. Unauthenticated attackers can exploit this to modify plugin configurations via forged requests, provided they can induce a site administrator to click a malicious link. Affected settings include API tokens, access tokens, economic activity, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings.

Recommendations Update the plugin to a version newer than 2.0.2.