CVE-2026-1800

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1800", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-03T11:15:34.051Z", "datePublished": "2026-03-21T03:26:31.793Z", "dateUpdated": "2026-04-08T16:34:37.372Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:37.372Z"}, "affected": [{"vendor": "wisdomlogix", "product": "Fonts Manager | Custom Fonts", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018fmcfIdSelectedFnt\u2019 parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Fonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a37f3bf-5eaf-449d-a1d0-c86ae1a61078?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L552"}, {"url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L573"}, {"url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L626"}, {"url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/classes/fmcf_stylish_font.php#L99"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tarc\u00edsio Luchesi De Almeida Silva"}], "timeline": [{"time": "2026-03-20T15:14:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T18:20:02.500889Z", "id": "CVE-2026-1800", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T18:21:03.794Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1800", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T18:20:02.500889Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T18:20:50.547Z"}}], "cna": {"title": "Fonts Manager | Custom Fonts <= 1.2 - Unauthenticated SQL Injection via fmcfIdSelectedFnt parameter", "credits": [{"lang": "en", "type": "finder", "value": "Tarc\u00edsio Luchesi De Almeida Silva"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "wisdomlogix", "product": "Fonts Manager | Custom Fonts", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:14:41.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a37f3bf-5eaf-449d-a1d0-c86ae1a61078?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L552"}, {"url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L573"}, {"url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L626"}, {"url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/classes/fmcf_stylish_font.php#L99"}], "descriptions": [{"lang": "en", "value": "The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018fmcfIdSelectedFnt\u2019 parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-03-21T03:26:31.793Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1800", "state": "PUBLISHED", "dateUpdated": "2026-03-23T18:21:03.794Z", "dateReserved": "2026-02-03T11:15:34.051Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:26:31.793Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Fonts Manager | Custom Fonts", "vendor": "wisdomlogix", "versions": [{"lessThanOrEqual": "1.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018fmcfIdSelectedFnt\u2019 parameter in all versions up to, and including, 1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}, {"lang": "es", "value": "El plugin Fonts Manager | Custom Fonts para WordPress es vulnerable a inyecci\u00f3n SQL basada en tiempo a trav\u00e9s del par\u00e1metro 'fmcfIdSelectedFnt' en todas las versiones hasta la 1.2, inclusive, debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y la falta de preparaci\u00f3n suficiente en la consulta SQL existente. Esto hace posible que atacantes no autenticados a\u00f1adan consultas SQL adicionales en consultas ya existentes que pueden usarse para extraer informaci\u00f3n sensible de la base de datos."}], "id": "CVE-2026-1800", "lastModified": "2026-06-17T10:16:32.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1800", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T18:20:02.500889Z", "version": "2.0.3"}}]}, "published": "2026-03-21T04:16:54.520", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/classes/fmcf_stylish_font.php#L99"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L552"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L573"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/fonts-manager-custom-fonts/tags/1.2/includes/fmcf-stylish-fonts-functions.php#L626"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0a37f3bf-5eaf-449d-a1d0-c86ae1a61078?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Fonts Manager | Custom Fonts", "source": "cna", "vendor": "wisdomlogix"}, "product": "fonts_manager_|_custom_fonts", "vendor": "wisdomlogix"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T06:29:22.945300+00:00", "value": {"mitigation_remediation": ["Update Fonts Manager | Custom Fonts plugin to a version newer than 1.2", "If update is not possible, uninstall or disable the plugin", "Verify that no unexpected access to the fmcfIdSelectedFnt parameter remains", "Maintain regular updates for WordPress core and all plugins"], "summary": {"action": "Immediate Patch", "impact": "Data Exfiltration via unauthenticated SQL injection"}, "threat_synthesis": {"affected_systems": "WordPress sites running the Fonts Manager | Custom Fonts plugin by wisdomlogix, versions up to and including 1.2, are affected. No later version is specified as a fix in the available data. Site administrators should check the plugin version and remove or update the plugin if the version is within the vulnerable range.", "description_and_impact": "The Fonts Manager | Custom Fonts plugin for WordPress is vulnerable to a time\u2011based SQL injection through the fmcfIdSelectedFnt parameter, allowing an attacker to inject arbitrary SQL statements. This weakness is based on insufficient input escaping and lack of prepared statements. The primary impact is the ability to read sensitive information from the database, leading to potential data compromise. The vulnerability is identified as CWE\u201189.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high-impact vulnerability. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, implying it has not yet been exploited in the wild. The attack vector is unauthenticated, meaning any web visitor can exploit the flaw. If successfully exploited, the attacker can retrieve confidential database contents without authentication, posing a significant threat to data confidentiality."}}}}, "created": "2026-03-23T09:51:03.950168+00:00", "updated": "2026-03-25T14:42:39.436731+00:00", "vendors": ["wisdomlogix", "wisdomlogix$PRODUCT$fonts_manager_|_custom_fonts", "wordpress", "wordpress$PRODUCT$wordpress"]}