PT-2026-3533 · WordPress · Custom Fonts – Host Your Fonts Locally

CVE-2025-14351 · Publicado 2026-01-20 · Atualizado 2026-01-20

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom Fonts – Host Your Fonts Locally plugin for WordPress versions up to and including 2.1.16

Description The plugin is susceptible to unauthorized data loss because of a missing capability check within the BCF Google Fonts Compatibility class constructor function. This allows unauthenticated attackers to delete the font directory and overwrite the theme.json file.

Recommendations Update the Custom Fonts – Host Your Fonts Locally plugin to a version newer than 2.1.16.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2025-14351

Produtos afetados

Custom Fonts – Host Your Fonts Locally

Referências · 6

• https://wordfence.com/threat-intel/vulnerabilities/id/60e3a506-8811-4e7d-a16c-02f91c757705?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-14351 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2013467659787010056 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2013465827270381957 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/custom-fonts/trunk/includes/class-bcf-google-fonts-compatibility.php#L88 · Nota
• https://plugins.trac.wordpress.org/changeset/3442237/custom-fonts · Nota