What is the CVSS score of EUVD-2026-39538?

EUVD-2026-39538 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of OMGF Pro are affected by EUVD-2026-39538?

OMGF Pro WordPress plugin (versions through 5.2.6) contains a critical arbitrary file upload vulnerability (CVSS 10.0) that allows unauthenticated attackers to deploy webshells and achieve complete…

How to fix or mitigate EUVD-2026-39538?

Within 24 hours: identify all WordPress installations using OMGF Pro versions through 5.2.6 and disable or remove the plugin immediately. Within 7 days: contact Daan.Dev for patch timeline and interim security guidance; implement compensating controls (see below). Within 30 days: monitor Daan.Dev's advisory channels for patch release; evaluate alternative file optimization solutions before re-enabling.

OMGF Pro EUVD-2026-39538

| CVE-2026-57700 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-25 Patchstack

GHSA-qxx8-x6c8-jhvr

WordPress File Upload Wordpress Plugin Omgf Pro

10.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-reachable upload with no auth/interaction per source vector; webshell yields full triad impact, but I scope it Unchanged (S:U) as compromise stays within the WordPress/server security authority rather than crossing to a distinct system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 18:50 vuln.today

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in Daan.Dev OMGF Pro allows Using Malicious Files.

This issue affects OMGF Pro: from n/a through 5.2.6.

AnalysisAI

Arbitrary file upload in Daan.Dev's OMGF Pro WordPress plugin (versions through 5.2.6) lets remote attackers upload files of dangerous types, enabling webshell deployment and full site/server takeover. The CVSS 3.1 base score is 10.0 with a scope-changed vector, and the vector's PR:N indicates the flaw is reachable without authentication. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

OMGF Pro (marketed as Host Google Fonts Pro, CPE cpe:2.3:a:daan.dev:omgf_pro) is the premium tier of the OMGF WordPress plugin, which downloads and self-hosts Google Fonts locally to improve privacy and page-load performance. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): an upload handler - plausibly the font-fetching/import or asset-write routine - fails to validate file type, extension, or content, allowing executable content (e.g. a PHP file) to be written into a web-accessible directory. Because WordPress executes PHP from within its uploads/plugin directories, an uploaded script can be requested directly and run in the server context.

RemediationAI

Upgrade OMGF Pro to a release later than 5.2.6 - the record bounds the vulnerable range at 5.2.6, but no exact fixed version number is provided in the input, so confirm the patched build via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/host-google-fonts-pro/vulnerability/wordpress-omgf-pro-plugin-5-2-6-arbitrary-file-upload-vulnerability) and the Daan.Dev account/update channel before deploying. Patch available per vendor advisory; released patched version not independently confirmed from this data. If an update cannot be applied immediately, compensating controls include: deactivating the OMGF Pro plugin (trade-off: Google Fonts revert to remote loading, affecting privacy/performance and possibly layout); placing a WAF rule to block multipart uploads to the plugin's admin-ajax/REST endpoints (trade-off: may break legitimate font imports); and adding a server rule to deny PHP execution within wp-content/uploads and the plugin's writable font directories (trade-off: low, but verify no legitimate dynamic asset relies on it). Restrict access to wp-admin and the plugin's upload/import actions to trusted IPs where feasible.