The Neos Connector for Fakturama plugin for WordPress contains a missing nonce check in the ncff_add_plugin_page() routine. This omission enables a Cross‑Site Request Forgery attack: an unauthenticated user can convince a site administrator to send a crafted request that updates plugin configuration. Because the plugin settings govern how Fakturama interacts with the WordPress site, an attacker could change operational parameters, potentially exposing the site to further compromise or disrupting business processes. The weakness is a classic CSRF vulnerability (CWE‑352).

All installations of the Neos Connector for Fakturama WordPress plugin with version 0.0.14 or earlier. The affected component is the plugin’s admin interface that handles settings updates. The vendor is neo2oo5, product Neos Connector for Fakturama. No additional products are listed.

The CVSS score of 4.3 indicates a low‑to‑moderate severity. Exploitation requires only that an administrator click a malicious link; the attacker does not need any privileged credentials. No EPSS information is available and the vulnerability is not in the CISA KEV catalog. Given the low effort required once the admin is deceived, the risk for sites that maintain older plugin versions is moderate, especially if they lack additional CSRF protections.