CVE-2026-8610: WordPress TypeSquare Plugin Auth Bypass

CVE-2026-8610 Overview

CVE-2026-8610 is an authorization bypass vulnerability in the TypeSquare Webfonts for ConoHa plugin for WordPress. The flaw affects all plugin versions up to and including 2.0.4. The plugin fails to verify whether the requesting user is authorized to perform sensitive actions on plugin settings. Authenticated attackers with subscriber-level access can modify site-wide font settings by submitting a POST request to any wp-admin page. Affected options include typesquare_auth (fontThemeUseType), show_post_form, and typesquare_fonttheme. For fontThemeUseType values 1 and 3, the plugin also omits nonce verification, exposing those code paths to cross-site request forgery (CSRF).

Critical Impact

Low-privileged WordPress users can alter site-wide font configuration, and unauthenticated visitors can trigger changes via CSRF on vulnerable branches.

Affected Products

• TypeSquare Webfonts for ConoHa plugin for WordPress, versions up to and including 2.0.4
• WordPress sites with subscriber-level registration enabled are at higher risk of exploitation
• Sites running the vulnerable plugin alongside authenticated administrative sessions exposed to CSRF

Discovery Timeline

• 2026-05-20 - CVE-2026-8610 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-8610

Vulnerability Analysis

The vulnerability is classified as Missing Authorization [CWE-862]. The plugin registers administrative handlers reachable through any wp-admin page but does not call current_user_can() or an equivalent capability check before processing POST data. As a result, any authenticated session, including subscriber accounts, can submit a request that updates plugin options stored in the WordPress options table. Attackers can change typesquare_auth, show_post_form, and typesquare_fonttheme, which control authentication mode, front-end form display, and the active font theme respectively.

Root Cause

The handler in typesquare-admin.php processes incoming POST parameters without enforcing a role or capability check. Authorization logic in inc/class/class.auth.php does not gate the option-write paths. Additionally, two branches of the fontThemeUseType handler skip the WordPress nonce verification step, removing the secondary control that would otherwise prevent forged cross-origin requests.

Attack Vector

Exploitation requires network access to the WordPress site. An attacker authenticates with any account at subscriber privilege or higher, then issues a POST request to any administrative endpoint with the targeted option values in the body. For fontThemeUseType values 1 and 3, an attacker can also host a malicious page that triggers a forged POST when an authenticated victim visits it, modifying settings without any direct credentials. The vulnerability does not yield code execution or data exfiltration, but it allows tampering with site presentation and authentication mode for the font service. Technical details are available in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-8610

Indicators of Compromise

• Unexpected changes to the typesquare_auth, show_post_form, or typesquare_fonttheme WordPress options
• POST requests to wp-admin pages originating from accounts with subscriber-level roles
• Cross-origin POST requests to wp-admin endpoints carrying fontThemeUseType parameters

Detection Strategies

• Audit the WordPress wp_options table for modifications to TypeSquare-related option keys
• Review web server access logs for POST requests to wp-admin URLs from low-privileged user sessions
• Correlate referer headers on wp-admin POST requests to identify off-site origins consistent with CSRF

Monitoring Recommendations

• Enable WordPress audit logging to track option updates and user role activity
• Alert on POST requests to administrative endpoints from accounts that lack administrative capability
• Monitor for repeated parameter patterns matching fontThemeUseType=1 or fontThemeUseType=3

How to Mitigate CVE-2026-8610

Immediate Actions Required

• Update the TypeSquare Webfonts for ConoHa plugin to a version newer than 2.0.4 once available from the vendor
• Disable the plugin on sites that do not require its functionality until a fixed release is installed
• Review and reset modified plugin options to their intended values
• Restrict new user registrations or limit the subscriber role on sites where the plugin remains active

Patch Information

No fixed version is referenced in the published advisory at the time of NVD publication. Administrators should monitor the WordPress plugin repository and the Wordfence Vulnerability Report for updates.

Workarounds

• Deactivate the TypeSquare Webfonts for ConoHa plugin until a patched release is published
• Block POST requests to wp-admin from non-administrator sessions using a web application firewall rule
• Disable open user registration to limit the pool of accounts able to exploit the authorization bypass

# Example WordPress CLI commands to mitigate exposure
wp plugin deactivate ts-webfonts-for-conoha
wp option update users_can_register 0
wp option get typesquare_auth
wp option get typesquare_fonttheme