{
 "id": "WPSEC-2026-1451",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1451/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1451/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1451/index.md",
 "title": "Fattura24 <= 8.2.0 - Unauthenticated Sensitive Information Exposure via Temporary Support Ticket Attachment File",
 "description": "The Fattura24 plugin for WordPress is vulnerable to Sensitive Information Exposure via the support ticket attachment in all versions up to, and including, 8.2.0, due to the fatt_24_send_ticket function writing the ticket content into the web-accessible plugin directory under a predictable name (source, account ID and timestamp). The file includes the plugin settings, which hold the API key, and order data. It is deleted only after the remote request finishes. This makes it possible for unauthenticated attackers who can predict the file name to read the API key and customer order data while the file exists.",
 "plugin": {
  "slug": "fattura24",
  "name": "Fattura24",
  "full_name": "Fattura24",
  "wordpress_org": "https://wordpress.org/plugins/fattura24/",
  "advisories_url": "https://wpsec.com/vuln/plugin/fattura24/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/fattura24"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-377"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "8.2.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 8.2.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "8.2.1",
 "remediation": "Update to 8.2.1 or later.",
 "fix_released": "2026-10-21T12:59:56+00:00",
 "published": "2026-10-22T13:52:08+00:00",
 "updated": "2026-10-22T09:33:10.493592+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1451/",
  "https://plugins.svn.wordpress.org/fattura24/tags/8.2.1/",
  "https://wordpress.org/plugins/fattura24/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/fattura24",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}