Unauthenticated File Upload Enables RCE in WooCommerce Plugin

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The FacturaONE para WooCommerce con VeriFactu plugin contains a critical authentication bypass vulnerability affecting versions before 5.37. An unauthenticated request handler relies solely on an empty cryptographic key for protection, allowing attackers to write arbitrary files to web-accessible directories and execute remote code. This vulnerability affects WordPress installations using this invoicing plugin, with a CVSS score of 9.0 emphasizing its severity. The flaw is particularly dangerous because it requires no authentication, no exploitation tricks, and no user interaction—making it trivially exploitable by any attacker who discovers a vulnerable instance.

Casky's 322 mapped skills across MITRE ATT&CK enable detection of the attack patterns underlying this vulnerability. The platform maps to TA0001 (Initial Access), where practitioners would identify suspicious HTTP requests to unauthenticated handlers attempting arbitrary file writes, and TA0043 (Reconnaissance), detecting pre-exploitation scanning for the vulnerable plugin version. Using Claude AI with extended reasoning, Casky practitioners would receive findings highlighting: (1) POST/GET requests to unprotected handlers lacking authentication tokens or valid signatures, (2) file upload attempts to web-accessible paths (wp-content, wp-uploads directories), (3) suspicious PHP or executable file writes in WordPress directories, and (4) abnormal access patterns to the plugin's request handlers. These behavioral indicators correlate directly to code execution attempts, enabling security teams to detect compromise before the attack succeeds.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14289.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-14289

Casky has 322 skills that investigate the attack patterns behind CVE-2026-14289. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn