WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution

Description

The plugin does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.
The same unauthenticated handler can also be abused to make the server perform arbitrary outbound requests (SSRF) and to redirect visitors to arbitrary external URLs.