OMGF <= 6.3.11 - Authenticated (Contributor+) Server-Side Request Forgery via Font Stylesheet Link Processing
- ID
- WPSEC-2026-0038
- Plugin
- OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. (host-webfonts-local)
- Affected
- all versions before 6.3.12
- Remediation
- Update to 6.3.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- OMGF on WPSec AttackSurface
- Fix released
- Published
Description
The GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.3.11. This is due to front-end link elements being treated as Google Fonts stylesheets whenever one of their attributes referenced the Google Fonts API, while the href that was actually requested could point at an arbitrary host and was fetched with wp_remote_get() following redirects, during any front-end page view (including a post preview). This makes it possible for authenticated attackers, with contributor-level access and above, who can get link markup into rendered post content, to make web requests from the server to arbitrary locations, including internal services, which can be used to query and modify information from internal services.
References
- https://wpsec.com/vuln/WPSEC-2026-0038/
- https://plugins.svn.wordpress.org/host-webfonts-local/tags/6.3.12/
- https://wordpress.org/plugins/host-webfonts-local/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS