{
 "id": "WPSEC-2026-1693",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1693/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1693/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1693/index.md",
 "title": "Rocket Font <= 1.2.3 - Unauthenticated Missing Authorization to Settings Update",
 "description": "The rocket-font plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.2.3 due to a missing capability check and missing nonce validation on the settings update logic in the Setting class constructor. This logic runs on plugins_loaded for every admin-context request, including unauthenticated requests to admin-post.php and admin-ajax.php. It writes option values straight from $_POST whenever the request carries page=rocket-font-setting and action=update, then regenerates the site-wide font stylesheet. This makes it possible for unauthenticated attackers to overwrite the plugin's settings and inject arbitrary CSS rules into the stylesheet served to every visitor, either directly or by tricking an administrator into submitting a forged request.",
 "plugin": {
  "slug": "rocket-font",
  "name": "Rocket Font",
  "full_name": "Rocket Font",
  "wordpress_org": "https://wordpress.org/plugins/rocket-font/",
  "advisories_url": "https://wpsec.com/vuln/plugin/rocket-font/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/rocket-font"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.1.2",
 "remediation": "Update to 2.1.2 or later.",
 "fix_released": "2026-10-26T05:16:08+00:00",
 "published": "2026-10-27T05:45:40+00:00",
 "updated": "2026-10-26T09:45:05.479283+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1693/",
  "https://plugins.svn.wordpress.org/rocket-font/tags/2.1.2/",
  "https://wordpress.org/plugins/rocket-font/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/rocket-font",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}