Fattura24 <= 8.1.15 - Unauthenticated Sensitive Information Exposure via Log Files
- ID
- WPSEC-2026-0411
- Plugin
- Fattura24 (fattura24)
- Affected
- all versions before 8.2.0
- Remediation
- Update to 8.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-532
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Fattura24 on WPSec AttackSurface
- Fix released
- Published
Description
The Fattura24 plugin for WordPress is vulnerable to Sensitive Information Exposure via its trace log files in all versions up to, and including, 8.1.15. This is due to the plugin always writing a trace log, which records WooCommerce order data and the invoice data sent to Fattura24, into its own publicly served plugin directory under a predictable, date-based file name (f24_trace_<dd_mm_yyyy>.log), while its 30-day cleanup never removed older files. This makes it possible for unauthenticated attackers to download the log files and obtain customers' personal data such as names, postal addresses, email addresses, phone numbers and fiscal codes.
References
- https://wpsec.com/vuln/WPSEC-2026-0411/
- https://plugins.svn.wordpress.org/fattura24/tags/8.2.0/
- https://wordpress.org/plugins/fattura24/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS