Custom Fonts – Host Your Fonts Locally, CVE-2025-14351

CVE, Research URL: CVE-2025-14351
Home page URL: Security reports for Custom Fonts – Host Your Fonts Locally
Application: Custom Fonts – Host Your Fonts Locally
Published on: Jan 20, 2026
Research Description: The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google_Fonts_Compatibility' class constructor function in all versions up to, and including, 2.1.16. This makes it possible for unauthenticated attackers to delete font directory and rewrite theme.json file.
Affected versions: max 2.1.17.
Status: vulnerable

Custom Fonts &#8211; Host Your Fonts Locally, CVE-2025-14351