What’s Vulnerable › Vulnerabilities
CVE-2026-14289: WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution
- Severity: critical (CVSS 9.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-27 · updated 2026-07-27
- Weakness: CWE-94
Description
The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.
Affected products
- FacturaONE para WooCommerce con VeriFactu: before 5.37 — fixed in 5.37
How to fix
Upgrade to a fixed version: FacturaONE para WooCommerce con VeriFactu 5.37. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-14289 or the next vulnerability affects your stack