PT-2026-64848 · WordPress · Facturaone Para Woocommerce Con Verifactu

Pedro Pinho · CVE-2026-14289 · Published 2026-07-27 · Updated 2026-07-27

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FacturaONE para WooCommerce con VeriFactu WordPress plugin versions prior to 5.37

Description An authentication failure in a request handler allows unauthenticated attackers to write arbitrary files into a web-accessible directory. This occurs because the handler relies on a cryptographic key that remains empty by default in an unconfigured state, leading to remote code execution.

Recommendations Update the plugin to version 5.37 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-14289

Affected Products

Facturaone Para Woocommerce Con Verifactu

References · 3

• 🔥 https://wpscan.com/vulnerability/f08365f6-57d2-475a-82c8-c4d27286569e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-14289 · Security Note
• https://t.me/CVEtracker/61304 · Telegram Post