CVE-2026-4143 is a CSRF vulnerability in the Neos Connector for Fakturama WordPress plugin (up to version 0.0.14). The vulnerability arises from the lack of nonce validation in the ncff_add_plugin_page() function responsible for handling settings updates. This allows attackers to forge requests that modify plugin settings by exploiting the trust of an authenticated administrator who performs an action such as clicking a crafted link. The vulnerability does not require privileges or direct user interaction beyond the administrator's action. The CVSS 3.1 base score is 4.3, reflecting network attack vector, low complexity, no privileges required, user interaction needed, and limited impact on integrity only.

An attacker can cause unauthorized changes to the plugin's settings by tricking an administrator into executing a forged request. This could lead to altered plugin behavior or configuration without the administrator's consent. There is no direct impact on confidentiality or availability reported. No known exploits are currently active in the wild.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory channels for updates. Until a fix is released, administrators should exercise caution when interacting with untrusted links or content that could trigger plugin settings changes. Implementing additional protective measures such as web application firewalls or restricting administrative access may help reduce risk.