CVE-2026-14289 is a critical vulnerability in the FacturaONE para WooCommerce con VeriFactu WordPress plugin prior to version 5.37. The issue stems from a request handler that does not enforce authentication and depends on a cryptographic key for protection. Since the key is empty by default when unconfigured, attackers can exploit this to write arbitrary files into directories accessible via the web server, enabling remote code execution. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code). No official patch or remediation level has been documented yet.

Successful exploitation allows unauthenticated attackers to write arbitrary files to web-accessible locations, resulting in remote code execution. This can lead to full compromise of the affected WordPress site, including data theft, site defacement, or further attacks on connected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should ensure the cryptographic key is properly configured to a non-empty value to prevent exploitation. Additionally, restricting access to the vulnerable request handler and monitoring for suspicious file writes may help mitigate risk.