The Custom Fonts – Host Your Fonts Locally WordPress plugin suffers from a missing capability check in the constructor of the BCF_Google_Fonts_Compatibility class. This authorization bypass vulnerability (CWE-862) enables unauthenticated attackers to perform unauthorized actions such as deleting the font directory and modifying the theme.json file. The vulnerability affects all versions up to 2.1.16. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, integrity impact is low, and no availability impact.

An unauthenticated attacker can delete font files and rewrite the theme.json configuration file, potentially disrupting website appearance or functionality. There is no direct impact on confidentiality or availability reported. The integrity of theme-related files can be compromised, which may affect site presentation or cause misconfiguration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin files and consider disabling the plugin if possible. Monitor official brainstormforce communications for updates or patches addressing this vulnerability.