# Fattura24 <= 8.2.0 - Unauthenticated Sensitive Information Exposure via Temporary Support Ticket Attachment File

- **ID:** WPSEC-2026-1451
- **Plugin:** Fattura24 (`fattura24`), https://wordpress.org/plugins/fattura24/
- **Affected versions:** all versions before 8.2.1
- **Fixed in:** 8.2.1 (Update to 8.2.1 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-377
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/fattura24
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1451/

## Description

The Fattura24 plugin for WordPress is vulnerable to Sensitive Information Exposure via the support ticket attachment in all versions up to, and including, 8.2.0, due to the fatt_24_send_ticket function writing the ticket content into the web-accessible plugin directory under a predictable name (source, account ID and timestamp). The file includes the plugin settings, which hold the API key, and order data. It is deleted only after the remote request finishes. This makes it possible for unauthenticated attackers who can predict the file name to read the API key and customer order data while the file exists.

## References

- https://wpsec.com/vuln/WPSEC-2026-1451/
- https://plugins.svn.wordpress.org/fattura24/tags/8.2.1/
- https://wordpress.org/plugins/fattura24/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1451/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.