CVE-2025-14351 Overview
CVE-2025-14351 affects the Custom Fonts – Host Your Fonts Locally plugin for WordPress in all versions up to and including 2.1.16. The plugin contains a missing capability check on the BCF_Google_Fonts_Compatibility class constructor, classified under [CWE-862] Missing Authorization. Unauthenticated attackers can invoke functionality that deletes the font directory and rewrites the theme.json file. The flaw enables unauthorized data loss and integrity impact on affected WordPress sites without requiring authentication or user interaction.
Critical Impact
Unauthenticated remote attackers can delete the plugin font directory and overwrite the active theme's theme.json file, causing site integrity loss.
Affected Products
- Custom Fonts – Host Your Fonts Locally plugin for WordPress
- All versions up to and including 2.1.16
- WordPress sites with the vulnerable plugin installed and activated
Discovery Timeline
- 2026-01-20 - CVE-2025-14351 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-14351
Vulnerability Analysis
The vulnerability resides in the BCF_Google_Fonts_Compatibility class constructor inside class-bcf-google-fonts-compatibility.php. The constructor wires destructive operations to hooks without verifying the caller's capability or nonce. As a result, any unauthenticated request that triggers the relevant hook can reach code paths that delete the font directory and rewrite theme.json. The Exploit Prediction Scoring System assessment indicates a low predicted probability of exploitation, but the attack requires no privileges and no user interaction.
Root Cause
The root cause is a missing capability check [CWE-862]. The plugin author did not call current_user_can() or validate a nonce before performing privileged file system actions. WordPress plugins must enforce authorization on any action that modifies site state. The constructor's reachable handlers trust the request implicitly, exposing destructive operations to anonymous callers.
Attack Vector
The attack vector is network-based. An attacker sends a crafted HTTP request to the WordPress site that triggers the unprotected handler registered by the BCF_Google_Fonts_Compatibility constructor. Successful invocation deletes the plugin-managed font directory and overwrites the theme's theme.json configuration file. The result is loss of locally hosted font assets and a corrupted or reset theme configuration. No authenticated session, social engineering, or prior foothold is required.
No public proof-of-concept exploit is documented in the available references. The vulnerability mechanism is described in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-14351
Indicators of Compromise
- Unexpected deletion or truncation of the Custom Fonts plugin font directory under wp-content/uploads/.
- Unexplained modifications to the active theme's theme.json file, particularly resets of typography or font-family entries.
- Inbound HTTP requests from unauthenticated sources targeting plugin endpoints associated with custom-fonts.
- Loss of locally hosted font files referenced by the front-end, resulting in fallback font rendering.
Detection Strategies
- Monitor WordPress file integrity for changes to theme.json and font upload directories using file integrity monitoring tools.
- Inspect web server access logs for anonymous requests reaching admin-ajax.php or REST endpoints tied to the Custom Fonts plugin.
- Audit installed plugin versions and flag any host running custom-fonts at version 2.1.16 or earlier.
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin hook invocations and file system mutations.
- Alert on anomalous DELETE or WRITE operations against theme and uploads directories.
- Correlate web traffic spikes from a single source with subsequent file system changes on the host.
How to Mitigate CVE-2025-14351
Immediate Actions Required
- Update the Custom Fonts – Host Your Fonts Locally plugin to a version later than 2.1.16 that includes the fix from WordPress Plugin Changeset 3442237.
- Back up theme.json and the font directory before applying updates to enable restoration if tampering already occurred.
- Review site files for unauthorized modifications and restore from a known-good backup if integrity loss is detected.
Patch Information
The vendor addressed the missing capability check in changeset 3442237 published on the WordPress plugin repository. Site administrators should upgrade through the WordPress admin dashboard or via WP-CLI using wp plugin update custom-fonts. Refer to the WordPress Plugin Changeset Update for the exact code-level fix that adds authorization enforcement to the affected class constructor.
Workarounds
- Deactivate the Custom Fonts plugin until the patched version can be installed.
- Restrict access to wp-admin and admin-ajax.php using a Web Application Firewall (WAF) rule that blocks anonymous requests targeting plugin endpoints.
- Apply least-privilege file permissions on wp-content/themes/ and wp-content/uploads/ to limit write access by the web server user where feasible.
# Update the vulnerable plugin using WP-CLI
wp plugin update custom-fonts
wp plugin get custom-fonts --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
