CVE-2026-8610
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The TypeSquare Webfonts for ConoHa plugin for WordPress up to version 2.0.4 is vulnerable to authorization bypass. It does not properly verify that a user is authorized to perform an action, allowing authenticated attackers with Subscriber-level access or higher to modify the plugin's site-wide font settings, including typesquare_auth, show_post_form, and typesquare_fonttheme, by submitting a POST request to any wp-admin page. For fontThemeUseType values 1 and 3, no nonce verification is performed either, making those branches additionally exploitable via CSRF.
Risk Assessment
The organization risks unauthorized changes to the site's appearance and potential injection of malicious font settings, which could affect brand perception or security.
Recommendation
Update the TypeSquare Webfonts for ConoHa plugin to the latest version that includes authorization and nonce fixes.
Original NVD description (English source)
The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's site-wide font settings, including the typesquare_auth option (fontThemeUseType), show_post_form, and typesquare_fonttheme, by submitting a POST request to any wp-admin page. For fontThemeUseType values 1 and 3, no nonce verification is performed either, meaning those branches are additionally exploitable via cross-site request forgery.