The Facturación Electrónica Costa Rica WordPress plugin contains a Cross‑Site Request Forgery flaw caused by missing or incorrect nonce validation in the configuration update function. An attacker can use a forged request to change critical plugin settings such as API tokens, access tokens, economic activity identifiers, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings. This could enable the creation of fraudulent invoices, unauthorized use of the platform’s financial interfaces, or disruption of business processes managed by the plugin.

All installations of the Facturación Electrónica Costa Rica WordPress plugin with versions 2.0.2 or earlier are affected. Site administrators using this plugin in any WordPress environment fall under the scope of this vulnerability.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1 % indicates a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is that an attacker sends a malicious link or form to an administrator, who, if tricked into clicking or submitting it, will unintentionally modify the plugin’s settings. Although exploitation requires social engineering, the impact of unauthorized configuration changes makes the risk moderate for sites using the affected plugin.