Junglewise Threat Intelligence

CVE-2026-9720: Facturación Electrónica Costa Rica CSRF in fvcr_admin_page_html

CVE-2026-9720 · Severity: medium · CVSS 4.3 · Published 2026-07-29

Executive brief

The Facturación Electrónica Costa Rica plugin for WordPress, which manages electronic invoicing for businesses, is vulnerable to a security flaw that allows unauthorized configuration changes. By tricking a site administrator into clicking a malicious link, an attacker can modify critical settings such as API tokens, tax environment modes, and invoice emission flags. This could lead to business disruptions, incorrect tax reporting, or the redirection of financial data.

Technical details

The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on functions included by fvcr_admin_page_html. An unauthenticated attacker can exploit this by inducing a logged-in administrator to visit a malicious URL or submit a crafted form. Successful exploitation allows the attacker to modify sensitive plugin settings, including API and access tokens, Hacienda environment modes, exchange rates, and branch settings. The vulnerability affects all versions up to and including 2.0.2.

Affected products

  • facturadorvirtual Facturación Electrónica Costa Rica <= 2.0.2

Timeline

  • 2026-07-29: disclosed
  • 2026-07-29: advisory

References