SuperFaktura WooCommerce

SuperFaktura WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2024; it is fixed as of October 2026. Their average CVSS score is 5.4, and the most serious one scores 5.4 out of 10.

The most common weakness is Server-Side Request Forgery (SSRF), behind 1 of the records (100%).

The one issue recorded for SuperFaktura WooCommerce has a vendor fix available, so running the current release closes it.

All of these findings were reported by Lucio Sá. SuperFaktura WooCommerce is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium
5.4/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all SuperFaktura WooCommerce vulnerabilities before they are exploited.

Highest severity on recordCVSS 5.4CVE-2024-1758

SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery

Read the full analysis

Vulnerability Records

1 records
SuperFaktura WooCommerce banner
Latestv1.59.2

SuperFaktura WooCommerce

superfaktura

Author

superfaktura

4.9(16)
98/100
Last Updated
2026-10-19 (9d ago)
Active Installs
2,000+
Downloads
145,596
Requires WP
4.4+
Requires PHP
7.4+
Tested up to
WP 7.1.3
Created
2015-03-21 (12y ago)
Requires Plugins
woocommerce

SuperFaktura extension for WooCommerce enables you to create invoices using third-party online app SuperFaktura. SuperFaktura is an online invoicing system for small business owners available in Slovakia (superfaktura.sk) and Czech Republic (superfaktura.cz). Features, answers to frequently asked questions and news about the plugin (in Slovak) are on its website superfaktura.2day.sk. Main features of SuperFaktura WooCommerce include: Automatically create invoices in SuperFaktura. Add fields for invoice details to WooCommerce Checkout form. Link to the invoice is added to Customer notification email sent by WooCommerce Order detail WooCommerce My Account page Set your own rules, when proforma or real invoice should be generated. Want to send proforma invoice on order creation and real invoice after payment? We got that covered. Custom invoice numbering. This plugin is not directly associated with superfaktura.sk, s.r.o. or with superfaktura cz, s.r.o. or oficially supported by their developers. Created by Ján Bočínec with the support of Slovak WordPress community and WordPress agency Webikon. Since 2017 maintained by 2day.sk. External services This plugin connects to the following external services. SuperFaktúra API (moja.superfaktura.sk, moje.superfaktura.cz, meine.superfaktura.at, or the sandbox at sandbox.superfaktura.sk and sandbox.superfaktura.cz) The plugin creates, updates and reads invoices, proforma invoices and credit notes in your SuperFaktúra account. It sends your API credentials and the order data needed for the document: the customer’s billing and shipping details (including company IDs and VAT number), ordered items, prices, payment and shipping method. With every request it also sends the WordPress, WooCommerce, plugin and PHP versions and your shop’s domain name. It connects when a document is created or regenerated (automatically on an order status change or manually), when SuperFaktúra reports a paid invoice to your shop, when the PDF is attached to an email, and when you test the connection or open the plugin settings. Terms of use: superfaktura.sk, superfaktura.cz. Privacy policy: superfaktura.sk, superfaktura.cz. VIES VAT number validation by the European Commission (ec.europa.eu) Only when “Validate VAT #” is enabled, the plugin sends the VAT number entered at checkout to VIES to check that it is valid. Service: VIES. Privacy policy: European Commission. Plugin announcements by 2day.sk (sf.2day.sk) When “Announcements” is enabled in WooCommerce > Settings > SuperFaktura > Integration (enabled by default), the plugin downloads once a day a small file with announcements about SuperFaktura and this plugin (for example about eFaktúra), its signature and up to 4 images from https://sf.2day.sk/woocommerce/. The announcements are shown in the admin only to users who can manage WooCommerce, and each can be closed. The request contains no data about your shop, users or customers: the server receives only your server’s IP address and the user agent “SuperFaktura-WooCommerce/” with the plugin version, as in any web request. The service is operated by 2day.sk, the maintainer of this plugin. Developers can also turn the download off with the filter sf_remote_messages_enabled.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C