CVE-2026-14289: FacturaONE WordPress Plugin RCE Flaw

CVE-2026-14289 Overview

CVE-2026-14289 affects the FacturaONE para WooCommerce con VeriFactu WordPress plugin in versions prior to 5.37. The plugin exposes a request handler that lacks authentication and relies solely on a cryptographic key check. That key is empty in the default, unconfigured installation state. Unauthenticated attackers can invoke the handler to write arbitrary files into a web-accessible directory and achieve remote code execution on the underlying host. The flaw is classified under [CWE-94] (Improper Control of Generation of Code) and impacts confidentiality, integrity, and availability of the WordPress site and its data.

Critical Impact
Unauthenticated remote attackers can write arbitrary files to a web-accessible location and execute code on the WordPress server.

Affected Products

FacturaONE para WooCommerce con VeriFactu WordPress plugin versions before 5.37
WordPress installations running the vulnerable plugin in default, unconfigured state
WooCommerce sites integrated with the FacturaONE VeriFactu invoicing module

Discovery Timeline

2026-07-27 - CVE-2026-14289 published to the National Vulnerability Database
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-14289

Vulnerability Analysis

The FacturaONE para WooCommerce con VeriFactu plugin registers a request handler that processes external input without validating the identity of the caller. Instead of standard WordPress capability or nonce checks, the handler compares an incoming value against a cryptographic key stored in plugin configuration. In a freshly installed or unconfigured deployment, this key is an empty string. An attacker submitting an empty value satisfies the comparison and passes the only gating check protecting the handler.

Once past the check, the handler processes attacker-controlled input that determines file contents and destination paths. The plugin writes the resulting file into a directory served by the web server, giving the attacker a path to a PHP payload reachable over HTTP. Requesting the newly written file executes attacker-supplied PHP under the web server user, yielding full remote code execution on the WordPress host.

Root Cause

The root cause is a design defect combining missing authentication with a secret-based fallback that defaults to an empty value. Treating an empty secret as a valid credential eliminates the intended control. Coupled with unchecked file write primitives, this results in code injection categorized as [CWE-94].

Attack Vector

Exploitation occurs over the network. An unauthenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint on a WordPress site running a version prior to 5.37. No user interaction is required. Refer to the WPScan Vulnerability Report for technical specifics of the request structure. Public exploit code was not listed at the time of publication.

Detection Methods for CVE-2026-14289

Indicators of Compromise

Unexpected .php files appearing under plugin, uploads, or other web-accessible directories, particularly with recent modification timestamps
HTTP POST requests targeting FacturaONE plugin endpoints from unauthenticated clients followed by GET requests to newly created files
New WordPress admin users, scheduled tasks, or modifications to wp-config.php following anomalous plugin traffic
Outbound connections from the PHP-FPM or web server process to unfamiliar hosts

Detection Strategies

Monitor the WordPress wp-content/plugins and wp-content/uploads directories for file creation events attributable to the web server user.
Alert on HTTP requests to FacturaONE plugin handlers that include file-write parameters or base64-encoded payloads.
Correlate web server access logs with process execution on the host to detect PHP interpreter spawning shells or system utilities.

Monitoring Recommendations

Enable file integrity monitoring across the WordPress document root and plugin directories.
Ship web server access and error logs, PHP error logs, and host process telemetry to a centralized analytics platform for correlation.
Track installed plugin versions across the WordPress fleet to identify hosts still running FacturaONE below 5.37.

How to Mitigate CVE-2026-14289

Immediate Actions Required

Update the FacturaONE para WooCommerce con VeriFactu plugin to version 5.37 or later on all WordPress sites.
Audit web-accessible directories for unauthorized .php files created since the plugin was installed and remove any confirmed webshells.
Rotate WordPress administrator credentials, API keys, and database secrets if compromise indicators are present.

Patch Information

The vendor addressed CVE-2026-14289 in FacturaONE para WooCommerce con VeriFactu version 5.37. Site administrators should upgrade through the WordPress plugin manager or by replacing the plugin directory with the patched release. See the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the FacturaONE plugin until upgrading to version 5.37 is possible.
Restrict access to plugin endpoints at the reverse proxy or web application firewall layer, blocking requests from untrusted networks.
Configure the web server to deny PHP execution in wp-content/uploads and other directories that should only serve static content.

bash

# Nginx configuration example: deny PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}