WordPress Plugin Vulnerabilities

TypeSquare Webfonts < 2.0.8 - Missing Authorization via typesquare_admin_init()

Description

The TypeSquare Webfonts plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the typesquare_admin_init() function in versions up to, and including, 2.0.7. This makes it possible for unauthenticated attackers to update the font list.

Affects Plugins

Plugin icon
xserver-typesquare-webfonts
Fixed in 2.0.8

References

CVE
CVE-2024-43120
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/e42cef39-35d7-4ef5-99da-c34d3ccab667

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
1e7a21af-e981-4a2b-a652-808c5bc85157

Timeline

Publicly Published
2024-08-07 (about 1 year ago)
Added
2024-08-14 (about 1 year ago)
Last Updated
2024-08-14 (about 1 year ago)

Other

Published
Title
Published
2025-10-16
Title
Social proof testimonials and reviews by Repuso < 5.30 - Missing Authorization
Published
2026-06-23
Title
Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action
Published
2024-06-20
Title
License Manager for WooCommerce < 3.0.7 - Improper Authorization to Authenticated(Contributor+) Sensitive Information Exposure
Published
2024-04-01
Title
Sharkdropship for AliExpress Dropshipping and Affiliate < 2.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Published
2024-04-25
Title
EPROLO Dropshipping < 1.7.2 - Missing Authorization