Configuration tampering via missing nonce validation

Cross-site request forgery in Facturación Electrónica Costa Rica 2.0.2 and earlier allows remote attackers to alter plugin settings. The configuration handler included by fvcr_admin_page_html accepts administrator form submissions without valid nonce verification and writes attacker-selected tokens, tax activity, environment, issuance, exchange-rate, and branch values. Exploitation requires an authenticated site administrator to follow a crafted link or submit a forged request, after which the attacker can disrupt electronic-invoice configuration without gaining direct account access.