CVE-2026-9720: WordPress Facturación Electrónica CSRF Flaw

CVE-2026-9720 Overview

CVE-2026-9720 is a Cross-Site Request Forgery (CSRF) vulnerability in the Facturación Electrónica Costa Rica plugin for WordPress. The flaw affects all versions up to and including 2.0.2. The plugin fails to validate nonces in the administrative configuration handler included by fvcr_admin_page_html. Unauthenticated attackers can leverage a forged request to modify plugin configuration when an administrator is tricked into clicking a crafted link. Configurable values at risk include API tokens, access tokens, economic activity settings, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings. The vulnerability is tracked under CWE-352.

Critical Impact
Successful exploitation lets attackers silently overwrite billing integration credentials and toggle invoice emission behavior for Costa Rica electronic invoicing, disrupting fiscal compliance.

Affected Products

Facturación Electrónica Costa Rica plugin for WordPress — all versions ≤ 2.0.2
WordPress sites using the factura-electronica-cr plugin
Administrator sessions authenticated to vulnerable WordPress installations

Discovery Timeline

2026-07-29 - CVE-2026-9720 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-9720

Vulnerability Analysis

The plugin exposes an administrative configuration page rendered by fvcr_admin_page_html. The handler that processes configuration updates does not verify a WordPress nonce or equivalent anti-CSRF token before applying changes. Because WordPress relies on nonces to bind a request to a specific user and action, their absence removes the primary defense against forged cross-origin submissions.

An attacker crafts an HTML page containing a form or <img> tag that submits to the vulnerable configuration endpoint. When a logged-in administrator loads the attacker-controlled content, the browser attaches the WordPress authentication cookie, and the request executes with administrator privileges. See the Wordfence Vulnerability Analysis for the source-level trace.

Root Cause

The root cause is missing or incorrect nonce validation in the global-scope code included by fvcr_admin_page_html. The affected handlers, referenced at lines 52 and 87 of admin/configuration.php and in functions.php, process POST data without calling wp_verify_nonce or check_admin_referer.

Attack Vector

Exploitation requires user interaction from an authenticated administrator, such as clicking a malicious link or visiting a hostile page. The attacker does not need credentials or prior access to the target site. Once the administrator triggers the forged request, the attacker can replace Hacienda API tokens, alter the environment mode between production and staging, flip invoice or ticket emission flags, and modify exchange rate and branch settings.

No verified proof-of-concept code has been published. The vulnerability mechanism is described in prose because verified exploit code is not available.

Detection Methods for CVE-2026-9720

Indicators of Compromise

Unexpected changes to Facturación Electrónica Costa Rica plugin options in wp_options, particularly fields storing API tokens, access tokens, or Hacienda environment mode
Administrator sessions that submit POST requests to the plugin configuration page with a Referer header pointing to an external domain
New or altered branch, exchange rate, or emission flag values that do not correlate with a documented administrative change

Detection Strategies

Enable WordPress audit logging to record option updates and correlate them with the initiating user, timestamp, and referer
Inspect web server access logs for POST requests to the plugin's admin configuration endpoint with off-site referers or missing anti-CSRF parameters
Compare current plugin settings against a known-good baseline and alert on drift in Hacienda credentials or emission flags

Monitoring Recommendations

Alert on modifications to plugin option keys associated with factura-electronica-cr
Monitor administrator accounts for unusual browsing patterns immediately preceding configuration changes
Track outbound Hacienda API traffic for authentication failures that may indicate replaced credentials

How to Mitigate CVE-2026-9720

Immediate Actions Required

Deactivate the Facturación Electrónica Costa Rica plugin until a patched release is confirmed installed
Rotate any Hacienda API tokens and access tokens configured in the plugin, treating current values as potentially exposed
Restrict administrator browsing habits and require administrators to log out of WordPress before browsing untrusted sites

Patch Information

At the time of NVD publication, all versions up to and including 2.0.2 are affected. Site owners should track the plugin's release notes and apply any version released after 2.0.2 that references CVE-2026-9720 or CWE-352 remediation. Consult the Wordfence Vulnerability Analysis for updated fix status.

Workarounds

Deploy a web application firewall rule that blocks POST requests to the plugin's admin configuration endpoint when the Referer header is missing or off-site
Enforce short administrator session lifetimes and require re-authentication for privileged actions
Limit administrator accounts to dedicated browsers or sessions that do not visit untrusted content

bash

# Example ModSecurity rule blocking off-site POSTs to the plugin configuration page
SecRule REQUEST_METHOD "@streq POST" \
  "chain,id:1029720,phase:2,deny,status:403,msg:'CVE-2026-9720 CSRF block'"
  SecRule REQUEST_URI "@contains /wp-admin/admin.php?page=fvcr" \
    "chain"
    SecRule REQUEST_HEADERS:Referer "!@beginsWith https://your-site.example/" "t:none"