What is the CVSS score of CVE-2026-61980?

CVE-2026-61980 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of OMGF Pro are affected by CVE-2026-61980?

OMGF Pro versions 5.2.7 and earlier contain an unauthenticated arbitrary file download vulnerability allowing remote attackers to retrieve sensitive server files including WordPress database…

How to fix or mitigate CVE-2026-61980?

Within 24 hours: inventory all OMGF Pro installations and document versions in use; deploy Web Application Firewall rules to block file-download requests to affected OMGF Pro endpoints; and enable file integrity monitoring on wp-config.php. Within 7 days: if OMGF Pro is non-critical, disable the plugin entirely until patched; rotate all database credentials as a precaution; implement network-level IP restrictions limiting access to the plugin; and audit access logs for exploitation indicators. Within 30 days: monitor vendor and Patchstack advisories for OMGF Pro 5.2.8 or later patch availability; test the patch in staging before production deployment; and conduct forensic analysis of access logs during the vulnerability window to identify unauthorized file access.

OMGF Pro CVE-2026-61980

EUVD-2026-57977 HIGH

Path Traversal (CWE-22)

2026-08-13 Patchstack

GHSA-5q4q-w97v-2hx5

WordPress Path Traversal Wordpress Plugin Omgf Pro

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-exposed unauthenticated endpoint with no complexity; read-only file access yields high confidentiality but zero integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:45 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

AnalysisAI

Unauthenticated arbitrary file download in OMGF Pro (versions 5.2.7 and earlier) allows any remote attacker to retrieve arbitrary files from the server filesystem without credentials, exposing sensitive data such as WordPress configuration files containing database credentials. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms trivial network-based exploitation with high confidentiality impact and zero authentication or user interaction required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Patchstack advisory lowers the barrier for threat actor discovery significantly.

Technical ContextAI

OMGF Pro (CPE: cpe:2.3:a:daan.dev:omgf_pro:*:*:*:*:*:*:*:*) is a premium WordPress plugin developed by daan.dev that enables self-hosting of Google Fonts to satisfy GDPR compliance requirements. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The plugin exposes a file retrieval endpoint that fails to properly sanitize or validate user-supplied path input, allowing directory traversal sequences such as '../../' to escape the intended directory boundary. Because the endpoint is accessible without authentication, any network-reachable attacker can supply arbitrary paths and receive the contents of any file readable by the web server process, including wp-config.php, .env files, or application secrets.

RemediationAI

The primary remediation is to upgrade OMGF Pro to a version beyond 5.2.7; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/host-google-fonts-pro/vulnerability/wordpress-omgf-pro-plugin-5-2-7-arbitrary-file-download-vulnerability?_s_id=cve or the daan.dev plugin changelog for the exact patched release version, which was not independently confirmed in the available intelligence data. If immediate upgrade is not feasible, a compensating control is to block access to the plugin's file download endpoint at the web server layer (nginx location deny or Apache mod_rewrite rule targeting the specific query parameter or route pattern) - note this will break the plugin's intended functionality. Additionally, ensure wp-config.php has filesystem permissions set to 400 or 440 (readable only by the web server owner) to limit the value of any successful traversal. Deactivating the plugin entirely until patched eliminates the attack surface with the trade-off of losing local Google Fonts self-hosting functionality.