CVE-2026-1800: 
WordPress vulnerability analysis and mitigation

CVE-2026-1800 is a time-based SQL injection vulnerability in the Fonts Manager | Custom Fonts WordPress plugin (by wisdomlogix), affecting all versions up to and including 1.2. The flaw allows unauthenticated remote attackers to append malicious SQL queries via the fmcfIdSelectedFnt parameter, enabling extraction of sensitive database contents. It was published on March 21, 2026, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, EUVD).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), stemming from insufficient escaping of user-supplied input and inadequate preparation of SQL queries in the plugin's codebase (Wordfence). The vulnerable parameter fmcfIdSelectedFnt is processed in multiple functions within fmcf-stylish-fonts-functions.php (lines 552, 573, 626) and fmcf_stylish_font.php (line 99) without proper sanitization or parameterized queries (WordPress Trac). The attack vector is network-accessible, requires no authentication, no privileges, and no user interaction, making it trivially exploitable. The technique is time-based blind SQL injection, where attackers infer database contents by measuring server response delays.

Successful exploitation allows unauthenticated attackers to extract sensitive information from the WordPress database, including user credentials (hashed passwords), email addresses, session tokens, and any other data stored in the database. The CVSS assessment reflects a high confidentiality impact with no integrity or availability impact, meaning the attack is read-only but can expose the full database contents. Compromised credentials could enable account takeover, privilege escalation to WordPress admin, and potential lateral movement within the hosting environment (Wordfence, EUVD).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.075%, indicating a low (but non-zero) probability of exploitation in the near term (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the zero-authentication requirement and network accessibility make it an attractive target for automated scanning tools.

1. Reconnaissance: Identify WordPress sites running the Fonts Manager | Custom Fonts plugin (versions ≤ 1.2) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/fonts-manager-custom-fonts).
2. Identify vulnerable endpoint: Locate the plugin's AJAX or front-end endpoint that processes the fmcfIdSelectedFnt parameter — this is handled in fmcf-stylish-fonts-functions.php.
3. Craft time-based payload: Inject a time-based SQL payload into the fmcfIdSelectedFnt parameter, such as appending AND SLEEP(5)-- or using conditional time delays (e.g., IF(1=1,SLEEP(5),0)) to confirm injection.
4. Enumerate database: Use automated tools like sqlmap with the --technique=T (time-based blind) flag against the vulnerable parameter to enumerate database names, tables, and columns.
5. Extract sensitive data: Target the WordPress wp_users table to extract usernames and hashed passwords, then attempt offline cracking or credential stuffing against the WordPress admin panel (Wordfence, WordPress Trac).

• Network: Unusual HTTP requests containing SQL keywords (SLEEP, BENCHMARK, IF, AND 1=, OR 1=) in the fmcfIdSelectedFnt parameter; repeated requests to plugin endpoints with varying time delays suggesting time-based probing.
• Logs: WordPress or web server access logs showing requests with URL-encoded SQL syntax targeting plugin-related endpoints; abnormally slow response times (e.g., 5-second intervals) for specific requests to the same endpoint.
• Process/Database: Elevated database query times or unusual SLEEP() function calls appearing in MySQL slow query logs; unexpected database enumeration queries against information_schema tables.

Users should update the Fonts Manager | Custom Fonts plugin to version 1.3 or later, which contains the fix for this vulnerability (Wordfence). As an interim workaround, site administrators can deactivate and remove the plugin until an update can be applied. Additionally, deploying a Web Application Firewall (WAF) with SQL injection rules (such as Wordfence or Cloudflare WAF) can help block exploitation attempts. Database access should be restricted to the minimum necessary privileges to limit the impact of any successful injection.

Wordfence published the vulnerability in their weekly WordPress vulnerability report for March 16–22, 2026, and it was picked up by automated security alert services including RedPacket Security and VulDB (Wordfence Blog, RedPacket Security). Social media coverage was limited to automated security alert accounts on Mastodon and Twitter/X, with no notable researcher commentary or broader media coverage observed.