CVE-2026-4143: XSRF in Neos Connector for Fakturama

The XSRF vulnerability in Neos Connector for Fakturama allows an attacker to craft malicious requests that appear to originate from a legitimate user, specifically a site administrator. By tricking an administrator into clicking a specially crafted link or visiting a malicious website, the attacker can execute arbitrary actions within the plugin's settings. This could include modifying invoice generation rules, payment configurations, or other critical plugin parameters. Successful exploitation could lead to data manipulation, financial loss, or disruption of business operations. While the plugin itself may not directly expose sensitive data, modifications to its settings could indirectly impact the security and integrity of the WordPress site.

1. Reserved2026-03-13
2. Published2026-03-21
3. Modified2026-04-08
4. EPSS updated2026-03-28

The primary mitigation for CVE-2026-4143 is to upgrade to a patched version of the Neos Connector for Fakturama plugin as soon as it becomes available. Until a patch is released, implement temporary workarounds to reduce the risk. These include carefully reviewing all plugin settings changes and implementing stricter access controls for WordPress administrator accounts. Consider using a WordPress security plugin with XSRF protection features. Implement a Web Application Firewall (WAF) with XSRF filtering rules to block suspicious requests. Monitor WordPress access logs for unusual activity and suspicious URLs.

Active installs

20

Plugin rating