# Rocket Font <= 1.2.3 - Unauthenticated Missing Authorization to Settings Update

- **ID:** WPSEC-2026-1693
- **Plugin:** Rocket Font (`rocket-font`), https://wordpress.org/plugins/rocket-font/
- **Affected versions:** all versions before 2.1.2
- **Fixed in:** 2.1.2 (Update to 2.1.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/rocket-font
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1693/

## Description

The rocket-font plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.2.3 due to a missing capability check and missing nonce validation on the settings update logic in the Setting class constructor. This logic runs on plugins_loaded for every admin-context request, including unauthenticated requests to admin-post.php and admin-ajax.php. It writes option values straight from $_POST whenever the request carries page=rocket-font-setting and action=update, then regenerates the site-wide font stylesheet. This makes it possible for unauthenticated attackers to overwrite the plugin's settings and inject arbitrary CSS rules into the stylesheet served to every visitor, either directly or by tricking an administrator into submitting a forged request.

## References

- https://wpsec.com/vuln/WPSEC-2026-1693/
- https://plugins.svn.wordpress.org/rocket-font/tags/2.1.2/
- https://wordpress.org/plugins/rocket-font/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1693/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.