CVE-2024-5489: 
WordPress vulnerability analysis and mitigation

The Wbcom Designs – Custom Font Uploader plugin for WordPress (CVE-2024-5489) contains a vulnerability related to unauthorized loss of data, discovered and disclosed on June 6, 2024. The vulnerability affects all versions up to and including 2.3.4 of the plugin. This security issue stems from a missing capability check in the 'cfu_delete_customfont' function (NVD Database).

The vulnerability is classified with a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. The core issue is identified as CWE-862 (Missing Authorization), where the plugin fails to implement proper authorization checks on the 'cfu_delete_customfont' function (NVD Database).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to delete any custom font from the WordPress installation. This unauthorized access to font deletion functionality could lead to loss of design consistency and potential disruption of website appearance (NVD Database).

The vulnerability requires an authenticated user with at least Subscriber-level access to exploit. The attack complexity is considered low, requiring no special conditions or user interaction to execute (NVD Database).

A patch has been released to address this vulnerability. Website administrators are advised to update their Custom Font Uploader plugin to version 2.4.0 or later, which includes the security fix (WordPress Plugin).