Borderless WordPress Plugin Missing Authorization Vulnerability in Icon Font Deletion

A vulnerability exists in the Borderless WordPress plugin, specifically in the 'remove_zipped_font' function, all versions through 1.5.9. The issue arises from a lack of proper capability checks, allowing authenticated attackers with Subscriber-level access or higher to delete previously uploaded icon fonts. This unauthorized data loss could impact users relying on custom icon packs for their WordPress sites.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of icon fonts, leading to potential disruption of custom icon usage on the site.

Remediation

Users can update to version 1.6.0 or a newer patched version to address this vulnerability.