CVE-2023-6600 – This vulnerability in the OMGF WordPress plugin... (How to Fix)

Q: What is the severity of CVE-2023-6600?

CVE-2023-6600 has a CVSS score of 8.6 (HIGH). This vulnerability in the OMGF WordPress plugin allows unauthenticated attackers to modify plugin settings and inject stored XSS payloads due to missing capability checks. It affects all versions up to 5.7.9, enabling attackers to potentially delete directories and compromise websites. WordPress sites using the vulnerable plugin are at risk.

📋 TL;DR

This vulnerability in the OMGF WordPress plugin allows unauthenticated attackers to modify plugin settings and inject stored XSS payloads due to missing capability checks. It affects all versions up to 5.7.9, enabling attackers to potentially delete directories and compromise websites. WordPress sites using the vulnerable plugin are at risk.

💻 Affected Systems

Products:

OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress Plugin

Versions: All versions up to and including 5.7.9

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: All WordPress installations with vulnerable plugin versions are affected regardless of configuration.

📦 What is this software?

Omgf by Daan

View all CVEs affecting Omgf →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete website takeover via stored XSS leading to admin account compromise, data theft, and directory deletion causing site destruction.

🟠

Likely Case

Stored XSS injection leading to session hijacking, defacement, or malware distribution to site visitors.

🟢

If Mitigated

Limited impact if proper WAF rules block unauthenticated admin requests and input sanitization is enforced elsewhere.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending crafted HTTP requests to the vulnerable endpoint. Multiple patch attempts indicate active exploitation attempts.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 5.7.10

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3009453/host-webfonts-local

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.' 4. Click 'Update Now' if available, or delete and reinstall version 5.7.10+. 5. Verify update completed successfully.

🔧 Temporary Workarounds

Temporary Plugin Deactivation

all

Disable the vulnerable plugin until patched

wp plugin deactivate host-webfonts-local

WAF Rule Block

all

Block unauthenticated POST requests to admin_init endpoints

🧯 If You Can't Patch

Remove plugin entirely and use alternative Google Fonts optimization solution
Implement strict WAF rules blocking all unauthenticated admin area access

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → OMGF plugin version. If version ≤5.7.9, vulnerable.

Check Version:

wp plugin get host-webfonts-local --field=version

Verify Fix Applied:

Confirm plugin version is 5.7.10 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unauthenticated POST requests to /wp-admin/admin-post.php with omgf_update_settings action
Unexpected plugin setting changes in database

Network Indicators:

HTTP POST requests to admin endpoints from unauthenticated sources
Suspicious JavaScript injection in plugin settings

SIEM Query:

source="wordpress.log" AND ("admin-post.php" AND "omgf_update_settings") AND status!=401

📊 Metadata

CVE ID: CVE-2023-6600

CVSS v3 Score: 8.6 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

CWE: CWE-79

Published: January 3, 2024

Last Updated: June 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-6600, you might also want to check these: