PT-2026-3533 · WordPress · Custom Fonts – Host Your Fonts Locally

Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-14351

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Custom Fonts – Host Your Fonts Locally plugin for WordPress versions up to and including 2.1.16

Description The plugin is susceptible to unauthorized data loss because of a missing capability check within the BCF Google Fonts Compatibility class constructor function. This allows unauthenticated attackers to delete the font directory and overwrite the theme.json file.

Recommendations Update the Custom Fonts – Host Your Fonts Locally plugin to a version newer than 2.1.16.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14351

Affected Products

Custom Fonts – Host Your Fonts Locally

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-14351 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/60e3a506-8811-4e7d-a16c-02f91c757705?source=cve · Note
• https://twitter.com/VulmonFeeds/status/2013467659787010056 · Twitter Post
• https://twitter.com/CVEnew/status/2013465827270381957 · Twitter Post
• https://plugins.trac.wordpress.org/browser/custom-fonts/trunk/includes/class-bcf-google-fonts-compatibility.php#L88 · Note
• https://plugins.trac.wordpress.org/changeset/3442237/custom-fonts · Note