CVE-2025-14351CWE-862

Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion

Medium · published January 20, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google_Fonts_Compatibility' class constructor function in all versions up to, and including, 2.1.16. This makes it possible for unauthenticated attackers to delete font directory and rewrite theme.json file.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-01-20T03:25Z
EPSS history
Timeline
  • 20 JAN 03:25Z
    Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion
    cvelistv5