Fattura24 <= 8.2.0 - Unauthenticated Sensitive Information Exposure via Temporary Support Ticket Attachment File
- ID
- WPSEC-2026-1451
- Plugin
- Fattura24 (fattura24)
- Affected
- all versions before 8.2.1
- Remediation
- Update to 8.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-377
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Fattura24 on WPSec AttackSurface
- Fix released
- Published
Description
The Fattura24 plugin for WordPress is vulnerable to Sensitive Information Exposure via the support ticket attachment in all versions up to, and including, 8.2.0, due to the fatt_24_send_ticket function writing the ticket content into the web-accessible plugin directory under a predictable name (source, account ID and timestamp). The file includes the plugin settings, which hold the API key, and order data. It is deleted only after the remote request finishes. This makes it possible for unauthenticated attackers who can predict the file name to read the API key and customer order data while the file exists.
References
- https://wpsec.com/vuln/WPSEC-2026-1451/
- https://plugins.svn.wordpress.org/fattura24/tags/8.2.1/
- https://wordpress.org/plugins/fattura24/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS