What is the CVSS score of CVE-2026-8610?

CVE-2026-8610 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

TypeSquare Webfonts CVE-2026-8610

EUVD-2026-31029 MEDIUM

Missing Authorization (CWE-862)

2026-05-20 Wordfence

GHSA-v25p-w2xw-5q7q

WordPress Authentication Bypass CSRF Wordpress Plugin Typesquare Webfonts For Conoha

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 20, 2026 - 02:40 vuln.today

DescriptionCVE.org

The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the plugin's site-wide font settings, including the typesquare_auth option (fontThemeUseType), show_post_form, and typesquare_fonttheme, by submitting a POST request to any wp-admin page. For fontThemeUseType values 1 and 3, no nonce verification is performed either, meaning those branches are additionally exploitable via cross-site request forgery.

AnalysisAI

Authorization bypass in the TypeSquare Webfonts for ConoHa WordPress plugin (all versions through 2.0.4) allows authenticated attackers with subscriber-level access to arbitrarily modify site-wide font configuration by submitting a POST request to any wp-admin page. The plugin fails to verify that the requesting user has permission to alter settings such as typesquare_auth (fontThemeUseType), show_post_form, and typesquare_fonttheme (CWE-862). Compounding the issue, when fontThemeUseType values 1 or 3 are targeted, nonce verification is also absent, making those specific code branches additionally exploitable via cross-site request forgery against higher-privileged users. No public exploit has been identified at time of analysis, and no confirmed patched version has been released.

Technical ContextAI

The affected product is the TypeSquare Webfonts for ConoHa WordPress plugin (CPE: cpe:2.3:a:conoha:typesquare_webfonts_for_conoha:*:*:*:*:*:*:*:*), a webfont delivery plugin for the ConoHa hosting platform. The root cause is CWE-862 (Missing Authorization): the plugin's admin handler code in typesquare-admin.php and inc/class/class.auth.php does not check whether the authenticated user has sufficient privilege to invoke font-setting mutations before processing POST parameters. Because WordPress routes all authenticated wp-admin requests through a shared endpoint, any logged-in subscriber can reach these handlers. The secondary CSRF exposure arises because branches handling fontThemeUseType values 1 and 3 lack nonce verification (a WordPress anti-CSRF mechanism), meaning those branches are reachable without the attacker needing their own authenticated session - they can instead forge a request from a victim's browser session.

RemediationAI

No vendor-released patch has been identified at time of analysis - the available references point to the vulnerable 2.0.4 source code, and no updated plugin version is referenced. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/88002a25-6890-4f8b-8a11-239b59d56672) for a patched release. As an interim compensating control, administrators can deactivate the plugin until a fix is available, which eliminates both the authorization bypass and CSRF vectors entirely at the cost of losing webfont functionality. Alternatively, restricting WordPress site registration to prevent untrusted subscriber-level accounts will eliminate the authenticated attack path; this does not address the CSRF vector. Implementing a web application firewall rule to block unauthenticated or low-privilege POST requests targeting the plugin's admin parameters can reduce CSRF exposure. Ensure WordPress nonce validation is enforced site-wide via security plugins (e.g., Wordfence, iThemes Security) as an additional layer.