blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-14289

CRITICAL 9.0 CVSS 3.1
Published
July 27, 2026
Last modified
July 27, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-94
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Description

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown FacturaONE para WooCommerce con VeriFactu — Before 5.37

References

  • wpscan.com https://wpscan.com/vulnerability/f08365f6-57d2-475a-82c8-c4d27286569e/
  • nvd.nist.gov Official NVD record