Security Alert Summary
The Neos Connector for Fakturama plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in versions up to and including 0.0.14. A missing nonce validation in the plugin settings handler allows an attacker to craft a request that, if an administrator is tricked into performing an action (for example by clicking a link), can modify the plugin’s settings without proper authorization.
CVE Details
- CVE ID: CVE-2026-4143
- Affected component: Neos Connector for Fakturama plugin for WordPress
- Affected versions: all versions up to and including 0.0.14
- Published: March 21, 2026 04:17:42 AM UTC
- Last modified: March 21, 2026 04:17:42 AM UTC
- CVSS v3.1: Base score 4.3, Medium;
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Privileges required: None
- User interaction: Required
- Authentication required: No
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness: CWE-352 (Cross-Site Request Forgery)
Technical Details
The vulnerability is a Cross-Site Request Forgery (CSRF) issue caused by missing nonce validation in the plugin’s settings handler. The CVE description specifically identifies a lack of nonce checking in the ncff_add_plugin_page() function, which processes settings updates. Because the request handler does not validate a proper nonce, an attacker can craft a forged request that triggers a settings change if an authenticated administrator performs the action (for example by following a malicious link).
This weakness affects integrity of the plugin configuration: an attacker who can induce an administrator to interact with a crafted request may be able to modify plugin settings. Per the CVSS data, there is no direct confidentiality or availability impact indicated and no authentication is required for the initial attack vector; however user interaction by an administrator is required.
How This Could Impact Your Website
In a realistic scenario, a site owner or administrator maintains the WordPress dashboard and plugin settings, while internal staff or external contractors may rely on integrations or features provided by installed plugins. If an attacker successfully tricks an administrator into clicking a crafted link, the attacker could change plugin settings without needing admin credentials. Practical consequences may include misconfiguration of integration points or altered plugin behavior that disrupts workflows relied upon by staff or contractors.
For example, an altered setting could change how the plugin processes or routes data, causing operational interruptions or incorrect behavior of the integration that staff expect to function normally. While the CVSS rating indicates integrity impact is low and there is no direct confidentiality disclosure indicated, configuration changes can still create business interruptions or increase opportunities for follow-on social engineering.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and accounts with administrative privileges.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from the site.
- Monitor site and admin activity logs for unusual behavior, such as unexpected settings changes or admin actions.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/tags/0.0.14/neosconnectorforfakturama-admin.php#L223
- https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/tags/0.0.14/neosconnectorforfakturama-admin.php#L231
- https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/neosconnectorforfakturama-admin.php#L223
- https://plugins.trac.wordpress.org/browser/neos-connector-for-fakturama/trunk/neosconnectorforfakturama-admin.php#L231
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ffc8de-e8e4-41b6-a4b9-79511fb950fc?source=cve
