The vulnerability identified as CVE-2025-14351 affects the 'Custom Fonts – Host Your Fonts Locally' WordPress plugin developed by Brainstormforce. This plugin enables WordPress site administrators to host fonts locally rather than relying on external sources like Google Fonts. The security flaw stems from a missing authorization (capability) check in the constructor function of the BCF_Google_Fonts_Compatibility class. Because this check is absent, unauthenticated attackers can invoke functionality that should be restricted to authorized users. Specifically, attackers can delete the font directory used by the plugin and rewrite the theme.json file, which controls theme settings and appearance. This unauthorized modification can lead to site defacement, broken font rendering, or other integrity issues affecting the website's presentation. The vulnerability affects all plugin versions up to and including 2.1.16, with no patch currently listed. The CVSS 3.1 base score is 5.3, indicating a medium severity level. The vector indicates the attack can be performed remotely over the network (AV:N), requires no privileges (PR:N), no user interaction (UI:N), and impacts integrity (I:L) but not confidentiality or availability. No known exploits have been reported in the wild as of the publication date. This vulnerability falls under CWE-862 (Missing Authorization), highlighting the lack of proper access control checks in the plugin's code.

The primary impact of this vulnerability is unauthorized integrity loss on affected WordPress sites. Attackers can delete font directories, potentially causing font loading failures, and rewrite the theme.json file, which could alter site appearance or break theme functionality. This may result in site defacement, degraded user experience, or loss of brand consistency. While confidentiality and availability are not directly impacted, the integrity compromise can indirectly affect availability if the site becomes unusable or requires restoration. For organizations relying on this plugin, especially those with high-traffic or brand-sensitive websites, the vulnerability could lead to reputational damage and increased operational costs for remediation. Since the attack requires no authentication or user interaction, exploitation can be automated and widespread if attackers target vulnerable sites. However, the lack of known exploits in the wild suggests limited active exploitation currently.

1. Immediate mitigation involves updating the 'Custom Fonts – Host Your Fonts Locally' plugin to a patched version once released by Brainstormforce. Monitor official channels for patch announcements. 2. If no patch is available, temporarily disable or uninstall the plugin to eliminate the attack surface. 3. Implement Web Application Firewall (WAF) rules to block unauthorized requests targeting the plugin’s endpoints or the BCF_Google_Fonts_Compatibility class functionality. 4. Restrict file system permissions on the font directory and theme.json file to prevent unauthorized modifications by the web server user. 5. Regularly back up theme.json and font directories to enable quick restoration in case of compromise. 6. Monitor website integrity and logs for suspicious activities related to font files or theme configuration changes. 7. Employ WordPress security plugins that enforce capability checks and detect unauthorized file changes. 8. Educate site administrators on the risks of installing plugins without proper security reviews and encourage minimal plugin usage to reduce attack surface.