CVE-2026-14289
CRITICALFacturaONE para WooCommerce con VeriFactu < 5.37 - Unauthenticated Remote Code Execution
Title source: manualDescription
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.
References (1)
Core 1
Core References
Exploit exploit
vdb-entry
technical-description
https://wpscan.com/vulnerability/f08365f6-57d2-475a-82c8-c4d27286569e/
Scores
CVSS v3
9.0
EPSS
0.0040
EPSS Percentile
32.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-94
Status
published
Products (1)
None/FacturaONE para WooCommerce con VeriFactu
< 5.37
Published
Jul 27, 2026
Tracked Since
Jul 27, 2026