CVE-2026-8610 is an authorization bypass vulnerability (CWE-862) in the TypeSquare Webfonts for ConoHa WordPress plugin versions up to 2.0.4. The plugin fails to properly verify user authorization before allowing changes to site-wide font settings, including typesquare_auth, show_post_form, and typesquare_fonttheme options. Authenticated users with subscriber-level privileges or higher can exploit this by submitting POST requests to wp-admin pages. For fontThemeUseType values 1 and 3, the plugin also lacks nonce verification, making those settings vulnerable to CSRF attacks. The CVSS 3.1 base score is 4.3, indicating a medium severity vulnerability with network attack vector, low attack complexity, and no user interaction required.

An attacker with subscriber-level access or higher can modify site-wide font settings in the plugin without proper authorization, potentially altering website appearance or behavior. The lack of nonce verification for certain settings increases the risk of CSRF exploitation. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been identified.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user privileges where possible and monitor for unauthorized changes to font settings. Consider disabling or removing the plugin if not essential. Implementing additional access controls or nonce verification at the application level may help mitigate risk.