OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy., CVE-2021-24638

CVE, Research URL: CVE-2021-24638
Home page URL: Security reports for OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Application: OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
Published on: Sep 20, 2021
Research Description: The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
Affected versions: max 4.5.4.
Status: vulnerable