CVE-2021-24638CWE-22

CVE-2021-24638: vulnerability in OMGF | Host Google Fonts Locally

OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API

Published · Updated

Follow this CVE+ Monitor OMGF | Host Google Fonts Locally

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.8%
The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows unauthenticated users to perform path traversal and overwrite arbitrary CSS file with Google Fonts CSS, or download fonts uploaded on Google Fonts website.
Affected products
Unknown · OMGF | Host Google Fonts Locally
Related CVEs — OMGF | Host Google Fonts Locally

In the same product, most dangerous first.

CVE-2021-25021—OMGF < 4.5.12 - Admin+ Arbitrary Folder Deletion via Path TraversalEPSS 1.1%CVE-2021-24639—OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder DeletionEPSS 0.9%