CITS Support SVG, WebP Media and TTF/OTF File Upload, Use Custom Fonts WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the CITS Support SVG, WebP Media and TTF/OTF File Upload, Use Custom Fonts plugin for WordPress, affecting all versions through 4.2. The vulnerability arises from inadequate nonce validation in the 'cits_settings_tab()' function, allowing unauthenticated attackers to manipulate the plugin's settings by tricking a site administrator into clicking a link.

Impact

Exploitation of this vulnerability allows for unauthorized changes to the plugin's settings, potentially leading to unauthorized font uploads or assignments.

Remediation

No known patch is available. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.