Description
WordPress Plugin OMGF-Host Google Fonts Locally is prone to multiple vulnerabilities, including directory traversal and security bypass vulnerabilities. Exploiting these issues could allow an attacker to obtain sensitive information that could aid in further attacks, or to perform otherwise restricted actions and subsequently delete arbitrary files/folders. WordPress Plugin OMGF-Host Google Fonts Locally version 4.5.3 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 4.5.4 or latest
References
https://sploitus.com/exploit?id=WPEX-ID:C783A746-F1FE-4D68-9D0A-477DE5DBB35C
https://sploitus.com/exploit?id=WPEX-ID:1ADA2A96-32AA-4E37-809C-705DB6026E0B
https://plugins.svn.wordpress.org/host-webfonts-local/trunk/readme.txt
Related Vulnerabilities
Joomla! Core 1.5.x Information Disclosure (1.5.0 - 1.5.15)
Jenkins 7PK - Security Features Vulnerability (CVE-2014-9635)
WebLogic CVE-2023-22086 Vulnerability (CVE-2023-22086)
WordPress Plugin Homepage SlideShow 'upload.php' Arbitrary File Upload (2.0)
Joomla Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-1432)