CVE-2021-24638: 
WordPress vulnerability analysis and mitigation

CVE-2021-24638 affects the OMGF (host-webfonts-local) WordPress plugin versions before 4.5.4. The vulnerability was discovered by apple502j and publicly disclosed on August 23, 2021. This security issue involves an unauthenticated path traversal vulnerability in the plugin's REST API functionality (WPScan Advisory).

The vulnerability stems from improper validation and escaping of the handle parameter in the REST API. It is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal). The vulnerability has received a CVSS v3.1 base score of 9.1 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (NVD).

When exploited, this vulnerability allows unauthenticated users to perform path traversal attacks, potentially overwriting arbitrary CSS files with Google Fonts CSS content. Additionally, attackers can download fonts uploaded on the Google Fonts website to specified directories on the target system (WPScan Advisory).

The vulnerability has been fixed in version 4.5.4 of the OMGF plugin. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan Advisory).