ANALYSIS · e8b9b047· FINISHED 2026-01-20 · PATCHDIFF

Folder Analysiscache/custom-fonts_2.1.16 → cache/custom-fonts_2.1.17✓ COMPLETED

Files2

Vulnerable1

True positives0

CVE matched1

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2025-14351

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 2 CVE 1 Vuln 1

SORT

1 files · page 1/1

includes/class-bcf-google-fonts-compatibility.php

AI: 1 vulnerabilities

CWE-352: Cross-Site Request Forgery (CSRF)CWE-639: Authorization Bypass Through User-Controlled Key CVE-2025-14351 1 FP

#%!d(float64=002)

1–1 of 1

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2025-14351

Security writeup for CVE-2025-14351

✓ 1 FILE

## The Exploit

Unauthenticated attackers can delete the plugin's local font cache simply by visiting the plugin admin page slug.

```bash
curl -i -s 'https://target.example.com/?page=bsf-custom-fonts' -o /dev/null -w '%{http_code}\n'
```

This request hits the vulnerable constructor in `BCF_Google_Fonts_Compatibility`. The attacker observes a normal HTTP response, and behind the scenes the plugin deletes the fonts directory and rewrites `theme.json` without requiring login or a nonce.

## What the Patch Did

Before:
```php
public function __construct() {
    if ( empty( $_GET['page'] ) || BSF_CUSTOM_FONTS_ADMIN_PAGE !== $_GET['page'] ) {
        return;
    }

$bcf_filesystem    = bcf_filesystem();
    $fonts_folder_path = $this->get_fonts_folder();

if ( file_exists( $fonts_folder_path ) ) {
        $bcf_filesystem->delete( $fonts_folder_path, true, 'd' );
    }

self::delete_all_theme_font_family();
    add_action( 'admin_init', array( $this, 'update_fse_theme_json' ) );
}
```

After:
```php
public function __construct() {
    add_action( 'admin_init', array( $this, 'maybe_rebuild_fonts' ), 10 );
}

public function maybe_rebuild_fonts() {
    if ( empty( $_GET['page'] ) || BSF_CUSTOM_FONTS_ADMIN_PAGE !== $_GET['page'] ) {
        return;
    }

if ( ! isset( $_GET['bcf_rebuild_fonts'] ) ) {
        return;
    }

// Security: Capability and nonce checks.
    if ( ! current_user_can( 'manage_options' ) ) {
        wp_die( esc_html__( 'You do not have permission to perform this action.', 'custom-fonts' ), 403 );
    }

if ( ! isset( $_GET['bcf_nonce'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['bcf_nonce'] ) ), 'bcf_google_fonts_rebuild' ) ) {
        wp_die( esc_html__( 'Security check failed. Please try again.', 'custom-fonts' ), 403 );
    }

$bcf_filesystem    = bcf_filesystem();
    $fonts_folder_path = $this->get_fonts_folder();

if ( file_exists( $fonts_folder_path ) ) {
        $bcf_filesystem->delete( $fonts_folder_path, true, 'd' );
    }

self::delete_all_theme_font_family();
    $this->update_fse_theme_json();

$redirect_url = add_query_arg(
        array(
            'page'          => BSF_CUSTOM_FONTS_ADMIN_PAGE,
            'fonts_rebuilt' => '1',
        ),
        admin_url( 'themes.php' )
    );

wp_safe_redirect( $redirect_url );
    exit;
}
```

The patch added an explicit admin-init hook, a `bcf_rebuild_fonts` trigger guard, a `current_user_can('manage_options')` authorization check, and a `wp_verify_nonce()` verification.

## Root Cause

This is an authorization bypass / CSRF-style bug (CWE-862 / CWE-352) caused by destructive behavior running directly in a constructor with only `$_GET['page']` as a guard. The attacker controls `$_GET['page']`; if it matches `BSF_CUSTOM_FONTS_ADMIN_PAGE`, the plugin immediately calls the filesystem delete path and updates theme JSON. No capability check or nonce validation separates the attacker from the sink, so the request crosses the trust boundary from any visitor into privileged plugin cleanup logic.

## Why It Works

The vulnerability exists because the destructive code executes before any security gate is applied. In the original constructor, the only check is:
```php
if ( empty( $_GET['page'] ) || BSF_CUSTOM_FONTS_ADMIN_PAGE !== $_GET['page'] ) { return; }
```
That means any request with the right `page` value reaches the sink. The single load-bearing fix is the `current_user_can( 'manage_options' )` authorization check; without it, an unauthenticated or unauthorized visitor would still be able to trigger deletion. The nonce check is added for CSRF protection and to ensure the action is only performed from a valid admin workflow, while moving the process to `admin_init` and requiring `bcf_rebuild_fonts` prevents the side effect from happening during normal object construction.

## Hardening Checklist

- Use `current_user_can( 'manage_options' )` or the least privileged capability required before any filesystem mutation.
- Protect state-changing admin actions with `wp_verify_nonce()` and generate URLs with `wp_nonce_url()`.
- Avoid doing destructive work in plugin constructors; defer to action hooks such as `admin_init`.
- Require an explicit action trigger like `isset( $_GET['bcf_rebuild_fonts'] )` before performing cleanup.
- After completing admin actions, redirect with `wp_safe_redirect()` and `exit` to avoid duplicate execution.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2025-14351

CVE CVE-2025-14351

PRODUCT Folder Analysis

AFFECTED ≤ cache/custom-fonts_2.1.16

FIXED IN cache/custom-fonts_2.1.17

STATUS Generated

Security writeup · CVE-2025-14351

Source files · 1

includes/class-bcf-google-fonts-compatibility.php Linked

↗ NVD