CVE-2024-5489 is a missing authorization vulnerability (CWE-862) in the Wbcom Designs – Custom Font Uploader WordPress plugin, affecting all versions up to 2.3.4. The vulnerability arises because the 'cfu_delete_customfont' function lacks a capability check, allowing authenticated users with low privileges (Subscriber and above) to delete custom fonts arbitrarily. This can lead to unauthorized loss of data related to custom fonts within the plugin. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with an attack vector of network, low attack complexity, requiring privileges, no user interaction, and impacts availability only.

The vulnerability allows authenticated users with Subscriber-level access or higher to delete any custom font uploaded via the plugin. This results in availability impact by unauthorized deletion of custom fonts. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict plugin access to trusted users only and monitor user roles to limit Subscriber-level accounts. Avoid granting unnecessary privileges to users who do not require font management capabilities.