PT-2026-26815 · WordPress · Fonts Manager | Custom Fonts

Published 2026-03-21 · Updated 2026-03-21 · CVE-2026-1800

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fonts Manager | Custom Fonts plugin for WordPress versions prior to 1.3

Description The Fonts Manager | Custom Fonts plugin for WordPress is susceptible to time-based SQL Injection. This is due to inadequate escaping of user-supplied input and insufficient preparation of existing SQL queries. The fmcfIdSelectedFnt parameter is the point of entry for this issue. Successful exploitation allows unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database.

Recommendations Update to version 1.3 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-1800

Affected Products

Fonts Manager | Custom Fonts

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1800 · Security Note
• https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L552 · Note
• https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L573 · Note
• https://twitter.com/CVEnew/status/2035237314411340203 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/0a37f3bf-5eaf-449d-a1d0-c86ae1a61078?source=cve · Note
• https://twitter.com/RedPacketSec/status/2035460082494849104 · Twitter Post
• https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L626 · Note
• https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/classes/fmcf_stylish_font.php#L99 · Note