SuperFaktura WooCommerce <= 1.56.1 - Cross-Site Request Forgery to Invoice Creation and Regeneration

ID

WPSEC-2026-0733

Plugin

SuperFaktura WooCommerce (woocommerce-superfaktura)

Affected

all versions before 1.57.0

Remediation

Update to 1.57.0 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness

CWE-352

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-10

Attack surface

SuperFaktura WooCommerce on WPSec AttackSurface

Fix released

2026-10-08

Published

2026-10-10

Description

The SuperFaktura WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.56.1 due to missing nonce validation on the order document action links (sf_invoice_proforma_create, sf_invoice_regular_create, sf_invoice_cancel_create and sf_regen). This makes it possible for unauthenticated attackers to create or regenerate proforma invoices, invoices and credit notes for orders via a forged request, granted they can trick a logged-in shop manager or administrator into clicking a link.

References

• https://wpsec.com/vuln/WPSEC-2026-0733/
• https://plugins.svn.wordpress.org/woocommerce-superfaktura/tags/1.57.0/
• https://wordpress.org/plugins/woocommerce-superfaktura/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS