CVE-2024-43301
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in the Fonts Plugin for WordPress allows attackers to perform stored cross-site scripting (XSS) attacks. This affects WordPress sites using the Fonts Plugin (formerly Olympus Google Fonts) from all versions through 3.7.7. Attackers can trick authenticated administrators into executing malicious actions that inject persistent scripts.
💻 Affected Systems
- WordPress Fonts Plugin (formerly Olympus Google Fonts)
📦 What is this software?
Fonts by Fontsplugin
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover through persistent XSS payloads that steal admin credentials, deface websites, or install backdoors.
Likely Case
Attackers inject malicious JavaScript that steals session cookies, redirects users to phishing sites, or performs unauthorized actions on behalf of authenticated users.
If Mitigated
Limited impact with proper CSRF protections and content security policies in place.
🎯 Exploit Status
CSRF to XSS chain requires social engineering to trick authenticated users. Exploit details are publicly documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.8 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Fonts' plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 3.7.8+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily disable the Fonts plugin until patched.
wp plugin deactivate fonts
Implement CSRF Tokens
allAdd CSRF protection to WordPress forms if custom implementation is possible.
🧯 If You Can't Patch
- Restrict admin access to trusted networks only
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Fonts plugin version ≤3.7.7Check Version:
wp plugin list --name=fonts --field=versionVerify Fix Applied:
Confirm Fonts plugin version is 3.7.8 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with font-related actions
- Unexpected JavaScript injection in plugin settings
Network Indicators:
- CSRF attacks originating from external domains targeting admin endpoints
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" AND action="fonts_*")