CVE-2024-13768: WordPress CITS Support Plugin CSRF Flaw

CVE-2024-13768 Overview

CVE-2024-13768 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting the CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress. The flaw exists in all versions up to and including 4.2. The plugin fails to validate nonces on the cits_assign_fonts_tab() function. Unauthenticated attackers can craft a malicious request that deletes font assignments when a site administrator is tricked into clicking a link. Exploitation requires user interaction from a privileged user but no attacker authentication.

Critical Impact
An unauthenticated attacker can delete font assignments on a WordPress site by tricking an administrator into clicking a crafted link, causing loss of site customization integrity.

Affected Products

CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin for WordPress
All versions up to and including 4.2
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-03-22 - CVE-2024-13768 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13768

Vulnerability Analysis

The vulnerability resides in the cits_assign_fonts_tab() function within the plugin's cits-custom-fonts.php file. The function processes state-changing requests related to font assignments but does not verify a WordPress nonce. Because WordPress nonces are the primary anti-CSRF token mechanism, their absence allows an attacker to forge requests on behalf of an authenticated administrator.

When an administrator visits an attacker-controlled page or clicks a crafted link while logged in, the browser automatically submits the forged request along with valid session cookies. The plugin processes the request as if it originated from a legitimate administrative action, resulting in deletion of font assignments.

Root Cause

The root cause is missing or incorrect nonce validation in the cits_assign_fonts_tab() handler. WordPress provides wp_verify_nonce() and check_admin_referer() helpers to defend against CSRF, but these controls are not applied on the vulnerable code path. The absence of origin validation allows any authenticated administrator session to be leveraged by an off-site attacker.

Attack Vector

Exploitation proceeds over the network and requires user interaction. An attacker hosts a page containing an auto-submitting form or malicious link targeting the vulnerable endpoint on the victim's WordPress site. The attacker then delivers the link via phishing, social media, comments, or watering-hole techniques. When a signed-in administrator triggers the request, the plugin executes the font-assignment deletion. No credentials, tokens, or prior access to the target site are needed by the attacker.

Refer to the Wordfence Vulnerability Analysis and the WordPress Plugin Custom Fonts source for the vulnerable code path.

Detection Methods for CVE-2024-13768

Indicators of Compromise

Unexpected deletion or reset of custom font assignments in the WordPress site configuration.
HTTP requests to the plugin's font-assignment endpoints containing external Referer headers not originating from the site's own admin interface.
Administrator session activity immediately following clicks on suspicious external links or emails.

Detection Strategies

Review web server access logs for POST or GET requests to cits_assign_fonts_tab handlers that lack an internal Referer or Origin header matching the site domain.
Monitor WordPress audit logs for font-assignment changes that do not correspond to legitimate administrative sessions.
Correlate administrator browser activity with plugin state changes to identify request patterns consistent with CSRF exploitation.

Monitoring Recommendations

Enable a WordPress activity logging plugin to record configuration changes made by administrators, including font management actions.
Alert on POST requests to plugin admin endpoints that arrive without a valid WordPress nonce parameter.
Track administrator authentication and click-through activity to flag potential social engineering that precedes plugin state changes.

How to Mitigate CVE-2024-13768

Immediate Actions Required

Deactivate the CITS Support svg, webp Media and TTF,OTF File Upload plugin until a patched version is confirmed available.
Audit current font assignments and back up plugin configuration data before making changes.
Instruct administrators to log out of the WordPress admin panel before browsing untrusted sites and to avoid clicking unverified links.

Patch Information

At the time of publication, no patched version is referenced in the available advisory data. Monitor the Wordfence advisory and the WordPress plugin repository for a fix that adds wp_verify_nonce() or check_admin_referer() validation to the cits_assign_fonts_tab() function.

Workarounds

Restrict access to /wp-admin/ using IP allowlists or a Web Application Firewall (WAF) rule that blocks external referers on plugin endpoints.
Enforce use of a separate browser or browser profile for WordPress administration to reduce the risk of authenticated CSRF.
Consider replacing the plugin with an actively maintained alternative that implements proper nonce validation on all state-changing actions.

bash

# Example WAF rule concept: block requests to the vulnerable handler that lack a same-origin Referer
# (adapt to your WAF syntax)
SecRule REQUEST_URI "@contains cits_assign_fonts_tab" \
  "chain,deny,status:403,id:1013768,msg:'Potential CSRF against CITS Custom Fonts plugin'"
  SecRule &REQUEST_HEADERS:Referer "@eq 0"