← back to popular plugins
wordfence / plugin · custom-fonts

Custom Fonts – Host Your Fonts Locally

custom-fonts
total installs
400,000
total vulns
1
critical
0
high
0
medium
1
low
0
latest vuln
—
patched
1
unpatched
0
avg time to patch
—
vulnerabilities (1)
Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion
medium ✓ patched
cve id CVE-2025-14351 ↗
cvss score 5.3
cwe CWE-862: Missing Authorization
published Jan 19, 2026
The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google_Fonts_Compatibility' class constructor function in all versions up to, and including, 2.1.16. This makes it possible for unauthenticated attackers to delete font directory and rewrite theme.json file.