CVE-2024-43302: Fonts Plugin Authorization Bypass Flaw

CVE-2024-43302 Overview

CVE-2024-43302 is a missing authorization vulnerability in the Fonts Plugin for WordPress, formerly known as Olympus Google Fonts. The flaw affects all plugin versions up to and including 3.7.7. The plugin exposes actions that lack proper capability checks, allowing authenticated users with low privileges to invoke functions reserved for higher-privileged roles. The issue is tracked as CWE-862: Missing Authorization and was published to the National Vulnerability Database on November 1, 2024.

Critical Impact
Authenticated attackers with subscriber-level access can abuse unprotected plugin endpoints to modify site configuration, resulting in high impact to confidentiality, integrity, and availability.

Affected Products

Fonts Plugin (Olympus Google Fonts) for WordPress versions up to and including 3.7.7
WordPress installations with the fontsplugin:fonts component enabled
Sites permitting subscriber or higher-level account registration

Discovery Timeline

2024-11-01 - CVE-2024-43302 published to NVD via Patchstack
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43302

Vulnerability Analysis

The Fonts Plugin exposes administrative actions through WordPress hooks without validating the caller's role or capabilities. Authenticated users can send crafted requests to plugin endpoints and trigger operations intended only for administrators. Because WordPress installations frequently allow open user registration, the attack surface extends to any user who can obtain a subscriber account. Successful exploitation lets attackers alter plugin settings, inject arbitrary font-loading configurations, and manipulate site behavior. The vulnerability falls into the broken access control category and requires no user interaction from an administrator.

Root Cause

The root cause is the absence of current_user_can() checks within action handlers registered by the plugin. WordPress dispatches AJAX and admin-post callbacks to the handler regardless of the caller's role. Without a capability guard, the handler executes state-changing logic for any authenticated request. Nonce verification alone is insufficient because low-privileged users can obtain valid nonces from pages they legitimately access.

Attack Vector

An attacker registers or authenticates as a subscriber-level user on the target WordPress site. The attacker then issues an HTTP request to the vulnerable plugin action, supplying parameters that modify plugin configuration or trigger privileged behavior. The attack occurs over the network, requires low privileges, and demands no user interaction. Refer to the Patchstack Vulnerability Disclosure for the specific vulnerable action names and parameter structure.

Detection Methods for CVE-2024-43302

Indicators of Compromise

Unexpected changes to Fonts Plugin settings in the WordPress wp_options table under keys prefixed with olympus_ or fonts_plugin_
POST requests to admin-ajax.php or admin-post.php referencing plugin actions from user accounts without administrator roles
New or altered font-loading configurations that inject external stylesheet URLs
WordPress audit log entries showing option changes attributed to subscriber accounts

Detection Strategies

Review web server access logs for POST requests to /wp-admin/admin-ajax.php where the action parameter matches Fonts Plugin handlers and the requesting user is not an administrator
Correlate WordPress user role information with plugin option modification events
Deploy a WordPress security plugin capable of monitoring option changes and role-privilege mismatches

Monitoring Recommendations

Ingest WordPress application logs and web server logs into a centralized SIEM for correlation of authenticated actions against user roles
Alert on any modification to Fonts Plugin options originating from non-administrator sessions
Track new user registrations followed by rapid POST activity against plugin endpoints

How to Mitigate CVE-2024-43302

Immediate Actions Required

Update the Fonts Plugin to a version later than 3.7.7 as published by the vendor
Audit all WordPress user accounts and remove unused subscriber-level accounts
Review Fonts Plugin settings for unauthorized modifications and restore known-good configuration
Disable open user registration if it is not required by the site

Patch Information

The vendor released a patched version of the Fonts Plugin addressing the missing authorization checks. Site administrators should upgrade through the WordPress plugin dashboard or by replacing plugin files with the latest release. Confirm the installed version via the Plugins page after upgrade. Consult the Patchstack Vulnerability Disclosure for the fixed version details.

Workarounds

Deactivate the Fonts Plugin until the patched version is deployed
Restrict access to /wp-admin/admin-ajax.php for unauthenticated and low-privileged users via a Web Application Firewall rule
Set users_can_register to false in WordPress General Settings to reduce the pool of authenticated attackers

bash

# Update the Fonts Plugin using WP-CLI
wp plugin update olympus-google-fonts

# Verify installed version is greater than 3.7.7
wp plugin get olympus-google-fonts --field=version

# Disable open registration as a defense-in-depth measure
wp option update users_can_register 0