Neos Connector for Fakturama <= 0.0.14 - Cross-Site Request Forgery to Settings Update
mediumThe Neos Connector for Fakturama plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 0.0.14. This is due to missing nonce validation in the ncff_add_plugin_page() function which handles settings updates. This makes it possible for unauthenticated attackers to modify plug...
- CVSS:
- 4.3
- Affected:
- up to 0.0.14
- Fix:
- No patched version reported
- Disclosed:
- Mar 20, 2026