Rocket Font <= 1.2.3 - Unauthenticated Missing Authorization to Settings Update
- ID
- WPSEC-2026-1693
- Plugin
- Rocket Font (rocket-font)
- Affected
- all versions before 2.1.2
- Remediation
- Update to 2.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- Rocket Font on WPSec AttackSurface
- Fix released
- Published
Description
The rocket-font plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.2.3 due to a missing capability check and missing nonce validation on the settings update logic in the Setting class constructor. This logic runs on plugins_loaded for every admin-context request, including unauthenticated requests to admin-post.php and admin-ajax.php. It writes option values straight from $_POST whenever the request carries page=rocket-font-setting and action=update, then regenerates the site-wide font stylesheet. This makes it possible for unauthenticated attackers to overwrite the plugin's settings and inject arbitrary CSS rules into the stylesheet served to every visitor, either directly or by tricking an administrator into submitting a forged request.
References
- https://wpsec.com/vuln/WPSEC-2026-1693/
- https://plugins.svn.wordpress.org/rocket-font/tags/2.1.2/
- https://wordpress.org/plugins/rocket-font/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS