CVE-2026-9720 is a Cross-Site Request Forgery vulnerability affecting the Facturación Electrónica Costa Rica WordPress plugin in versions up to 2.0.2. The issue is due to missing or incorrect nonce validation in the function included by fvcr_admin_page_html, which is responsible for handling administrative configuration. An attacker can exploit this by crafting a forged request that, when executed by an authenticated administrator (e.g., by clicking a malicious link), modifies sensitive plugin configuration parameters including API tokens, access tokens, economic activity settings, Hacienda environment mode, invoice and ticket emission flags, exchange rate, and branch settings. The CVSS v3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, but requiring user interaction.

Successful exploitation allows an attacker to modify the plugin's configuration settings without authentication, potentially disrupting electronic invoicing operations or compromising integration with external services by altering API and access tokens. However, the vulnerability does not directly disclose data or cause denial of service. The impact is limited to integrity of plugin configuration and depends on tricking an administrator into performing the action.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or content while logged into WordPress with administrative privileges. Monitoring for updates from the plugin vendor is recommended to apply any forthcoming patches addressing this CSRF vulnerability.