What is the CVSS score of CVE-2026-1800?

CVE-2026-1800 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1800?

An unauthenticated SQL injection vulnerability in the Fonts Manager | Custom Fonts WordPress plugin (versions ≤1.2) allows attackers to extract sensitive database information without any user…

How to fix or mitigate CVE-2026-1800?

Within 24 hours: Audit all WordPress instances to identify installations of Fonts Manager | Custom Fonts plugin and document affected sites; immediately disable the plugin on all affected systems if business operations permit. Within 7 days: If the plugin cannot be disabled, implement WAF rules to block requests containing the 'fmcfIdSelectedFnt' parameter with SQL injection payloads, and isolate affected WordPress environments from production networks where possible. Within 30 days: Replace the vulnerable plugin with an alternative fonts management solution, or monitor vendor for patch release and apply immediately upon availability; conduct database audit to determine if unauthorized data extraction occurred.

WordPress CVE-2026-1800

EUVD-2026-14011 HIGH

SQL Injection (CWE-89)

2026-03-21 Wordfence

GHSA-h49v-28c5-9j37

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14011

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 7.5

DescriptionCVE.org

The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘fmcfIdSelectedFnt’ parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

AnalysisAI

The Fonts Manager | Custom Fonts plugin for WordPress contains a time-based SQL injection vulnerability in versions up to and including 1.2. Unauthenticated attackers can exploit the vulnerable 'fmcfIdSelectedFnt' parameter to extract sensitive database information without requiring any privileges or user interaction. The vulnerability has a CVSS score of 7.5, indicating high confidentiality impact, though no KEV listing or EPSS score is provided in the available data.

Technical ContextAI

This vulnerability affects the Fonts Manager | Custom Fonts WordPress plugin (CPE: cpe:2.3:a:wisdomlogix:fonts_manager_|_custom_fonts:*:*:*:*:*:*:*:*) developed by WisdomLogix. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), specifically a time-based blind SQL injection. The vulnerability exists in multiple locations within the codebase including fmcf-stylish-fonts-functions.php at lines 552, 573, and 626, as well as in fmcf_stylish_font.php at line 99. The flaw stems from insufficient escaping of user-supplied input in the 'fmcfIdSelectedFnt' parameter and inadequate parameterization of SQL queries, allowing attackers to append malicious SQL statements to existing database queries. Time-based SQL injection techniques enable attackers to infer database contents by measuring response delays even when direct error messages or data extraction is not possible.

RemediationAI

WordPress site administrators should immediately upgrade the Fonts Manager | Custom Fonts plugin to a version newer than 1.2 if a patched version has been released by WisdomLogix. Consult the Wordfence threat intelligence page at https://www.wordfence.com/threat-intel/vulnerabilities/id/0a37f3bf-5eaf-449d-a1d0-c86ae1a61078?source=cve for the latest remediation guidance and confirmed safe versions. If no patch is available, consider temporarily deactivating and removing the plugin until a security update is released, especially on sites handling sensitive information. As an interim measure, implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting the 'fmcfIdSelectedFnt' parameter, and review database access logs for suspicious query patterns or unusually long response times that might indicate exploitation attempts. Administrators should also ensure database user privileges follow the principle of least privilege to limit potential data exposure from successful SQL injection attacks.