The ashikcse CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts WordPress plugin suffers from a CSRF vulnerability affecting all versions up to 4.2. The root cause is the lack of proper nonce validation on the cits_assign_fonts_tab() function, which is responsible for assigning fonts. This allows an attacker to craft a malicious request that, if executed by an authenticated administrator, can delete font assignments without their consent. The vulnerability is classified under CWE-352 and has a CVSS 3.1 base score of 4.3, indicating medium severity. There is no vendor advisory or patch link provided, so the patch status is currently unknown.

An attacker can exploit this vulnerability to cause an authenticated administrator to unknowingly delete font assignments by tricking them into clicking a malicious link or performing a crafted action. This results in integrity loss of font assignment data but does not impact confidentiality or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking untrusted links or performing actions from unverified sources while logged into the affected WordPress plugin. Implementing additional CSRF protections or disabling the plugin temporarily may reduce risk.