CVE-2026-1800: Fonts Manager Custom Fonts SQLi Vulnerability

CVE-2026-1800 Overview

The Fonts Manager | Custom Fonts plugin for WordPress contains a time-based SQL Injection vulnerability in the fmcfIdSelectedFnt parameter affecting all versions up to and including version 1.2. The vulnerability exists due to insufficient escaping on user-supplied input and lack of proper preparation on the existing SQL query. This flaw allows unauthenticated attackers to append additional SQL queries into existing database queries, enabling extraction of sensitive information from the WordPress database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from the WordPress database, including user credentials, private content, and configuration information without any authentication requirements.

Affected Products

• Fonts Manager | Custom Fonts plugin for WordPress versions up to and including 1.2
• WordPress installations running vulnerable versions of the plugin
• All sites with the fonts-manager-custom-fonts plugin installed at version 1.2 or earlier

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-1800 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-1800

Vulnerability Analysis

This SQL Injection vulnerability allows unauthenticated remote attackers to manipulate database queries through the fmcfIdSelectedFnt parameter. The attack exploits a time-based blind SQL injection technique, meaning attackers can infer database contents by measuring response time delays caused by injected SQL commands. Since no authentication is required to exploit this vulnerability, any external attacker can target affected WordPress installations.

The vulnerability exists across multiple code locations within the plugin, including the fmcf_stylish_font.php class file and several functions within fmcf-stylish-fonts-functions.php. The lack of parameterized queries and insufficient input sanitization creates the conditions for SQL injection attacks.

Root Cause

The root cause is the plugin's failure to properly sanitize and escape user-supplied input in the fmcfIdSelectedFnt parameter before incorporating it into SQL queries. The code lacks sufficient use of WordPress's prepared statement functions (such as $wpdb->prepare()) which would normally protect against SQL injection attacks. This allows malicious SQL commands to be appended to legitimate queries.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. Attackers can craft malicious requests containing SQL injection payloads in the fmcfIdSelectedFnt parameter. Using time-based blind SQL injection techniques, attackers can systematically extract database contents by observing response time variations when conditional SQL statements evaluate as true or false.

The attack methodology typically involves sending requests with payloads like SLEEP() or BENCHMARK() functions combined with conditional statements to infer database schema and data values character by character.

Detection Methods for CVE-2026-1800

Indicators of Compromise

• Unusual database query patterns or slowdowns indicating time-based SQL injection attempts
• Web server logs containing suspicious fmcfIdSelectedFnt parameter values with SQL syntax characters
• Requests containing SQL keywords such as SLEEP, BENCHMARK, UNION, SELECT, or encoded SQL syntax
• Anomalous response time patterns indicating blind SQL injection probing
• Failed or unusual login attempts following database enumeration

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in request parameters
• Monitor web server access logs for requests targeting fonts-manager-custom-fonts plugin endpoints with suspicious parameters
• Configure database query logging to identify malformed or injection-style queries
• Deploy intrusion detection signatures for time-based SQL injection attack patterns

Monitoring Recommendations

• Enable detailed logging on WordPress installations to capture all plugin-related requests
• Set up alerting for abnormal database response times that may indicate SLEEP-based injection attempts
• Monitor for bulk data exfiltration patterns that could follow successful SQL injection exploitation
• Implement rate limiting on plugin endpoints to slow potential automated exploitation attempts

How to Mitigate CVE-2026-1800

Immediate Actions Required

• Update the Fonts Manager | Custom Fonts plugin to a patched version if available
• If no patch is available, immediately deactivate and remove the vulnerable plugin
• Review WordPress database logs for evidence of exploitation attempts
• Consider implementing a WAF rule to block requests with SQL injection patterns in the fmcfIdSelectedFnt parameter
• Audit WordPress user accounts and change credentials if compromise is suspected

Patch Information

Review the Wordfence Vulnerability Report for the latest patch status and remediation guidance. Additional technical details about the vulnerable code can be found in the WordPress Plugin Source Code Review.

Workarounds

• Deactivate the Fonts Manager | Custom Fonts plugin until a security patch is released
• Implement WAF rules to filter and block SQL injection payloads in requests to the plugin
• Restrict access to WordPress admin and plugin functionality through IP whitelisting where feasible
• Use a WordPress security plugin to add additional SQL injection protection layers

# Example WAF rule for ModSecurity to block SQL injection attempts
# Add to your Apache or Nginx ModSecurity configuration
SecRule ARGS:fmcfIdSelectedFnt "@detectSQLi" \
    "id:1001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'SQL Injection attempt blocked in fmcfIdSelectedFnt parameter',\
    logdata:'Matched Data: %{MATCHED_VAR}'"