Skip to content
Sign in
Not rated

CVE-2021-24639 The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the…

Description

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.

Affected products and versions

Product Affected versions Fixed in
OMGF | Host Google Fonts Locally 4.5 earliest → < 4.5.4 4.5.4

Other CVEs of OMGF | Host Google Fonts Locally

The 3 CVEs of OMGF | Host Google Fonts Locally →
CVE-2021-25021 The OMGF | Host Google Fonts Locally WordPress plugin before 4.5.12 does not validate the cache directory setting,… Not rated CVE-2021-24638 The OMGF WordPress plugin before 4.5.4 does not escape or validate the handle parameter of the REST API, which allows… Not rated
Track this CVE