A major vulnerability was discovered in the Google Fonts optimization plugin for WordPress

Plugin, OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy., optimizes the use of Google Fonts to reduce the impact on page speed and is also GDPR compliant, making it valuable for users in the European Union who want to use Google Fonts.

"The vulnerability is of particular concern because it allows unregistered attackers. "Unregistered" means that an attacker does not need to be registered on a website or have some level of credentials.

The vulnerability is described as the possibility of unauthorized deletion of directories and loading of malicious XSS scripts. 🚀

• 📌 This can lead to the attacker being able to use the privileges of the user visiting the site.

The cause of the vulnerability, as discovered by Wordfence researchers, is a lack of capability checking, a security feature that checks whether a user has access to a specific plugin feature, in this case, an admin-level feature. 🚀

"Wordfence describes the cause of the vulnerability: ... is vulnerable to unauthorized data modification and malicious script retention due to a lack of capability checks in the update_settings() function, which is attached via admin_init in all versions up to and including 5.7.9."

Wordfence also states that previous updates attempted to close this security gap, but considers version 5.7.10 to be the most secure version of the plugin. 🚀