A serious security flaw has been found in the popular “Use Any Font | Custom Font Uploader” plugin for WordPress. This vulnerability, identified as CVE-2021-24977, allows attackers to inject malicious code into websites. Due to its potential impact, it is rated as a High severity issue.
Overview
The “Use Any Font” plugin, designed to help WordPress users easily add custom fonts, had a critical authorization bypass. This flaw meant that unauthorized users could send their own custom CSS code to a website. This arbitrary CSS could then be processed and displayed to all visitors. More concerning, because the plugin did not properly clean up or escape this code on the backend, it could lead to what’s known as Stored Cross-Site Scripting (XSS). This means an attacker could plant malicious scripts that would then be shown to other users, including site administrators, potentially giving them control over parts of the website or stealing sensitive information.
CVE Details
- Product Name: Use Any Font WordPress Plugin
- Published: February 28, 2022
- Severity: High (CVSS 8.8)
- Status: Analyzed
Affected Products
The vulnerability impacts the “Use Any Font | Custom Font Uploader” WordPress plugin. Specifically, any versions of the plugin prior to 6.2.1 are affected by this issue. If your WordPress site uses this plugin and has not been updated, it is at risk.
Current Status
This vulnerability has been thoroughly analyzed and publicly disclosed. Details, including methods to exploit the flaw, are available in security databases, meaning attackers could potentially use this information if sites remain unpatched.
Severity Level
The vulnerability has a CVSS score of 8.8, classifying it as High severity. This rating reflects the significant danger posed by the flaw. An unauthenticated attacker, meaning someone without a user account or login credentials, can exploit this issue. The ability to inject arbitrary CSS and achieve Stored XSS allows an attacker to execute malicious scripts in the web browser of other users. This can lead to various attacks, such as stealing session cookies, defacing the website, or redirecting users to malicious sites. Because it affects all users, including administrators, the potential for harm is substantial.
Possible Solutions
The good news is that a fix is available. To protect your WordPress website from CVE-2021-24977, you must update the “Use Any Font | Custom Font Uploader” plugin immediately. The vulnerability was patched in version 6.2.1. It is crucial to upgrade to this version or any newer release as soon as possible.
As a general best practice, always keep your WordPress core, themes, and all plugins updated to their latest versions. Regular updates include important security fixes that protect your site from known vulnerabilities.
References
https://wpscan.com/vulnerability/739831e3-cdfb-4a22-9abf-6c594d7e3d75
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24977
