OMGF <= 6.3.11 - Authenticated (Contributor+) Path Traversal via Font Family Name
- ID
- WPSEC-2026-0040
- Plugin
- OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. (host-webfonts-local)
- Affected
- all versions before 6.3.12
- Remediation
- Update to 6.3.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- OMGF on WPSec AttackSurface
- Fix released
- Published
Description
The GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.3.11. This is due to the filename of downloaded font files, which is built from a font family name declared in a processed stylesheet, not being sanitized, and family names containing path separators not being rejected. This makes it possible for authenticated attackers, with contributor-level access and above, who can get a stylesheet from a host they control processed (see the Server-Side Request Forgery fixed in the same release), to write files with a font file extension (e.g. .woff2, .ttf) outside of the plugin's fonts directory.
References
- https://wpsec.com/vuln/WPSEC-2026-0040/
- https://plugins.svn.wordpress.org/host-webfonts-local/tags/6.3.12/
- https://wordpress.org/plugins/host-webfonts-local/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS