A critical SQL injection vulnerability in the Fonts Manager | Custom Fonts WordPress plugin allows unauthenticated attackers to extract sensitive database information.

This flaw is a time-based SQL injection (CWE-89) triggered via the fmcfIdSelectedFnt parameter. It allows an unauthenticated attacker to manipulate database queries, enabling the unauthorized extraction of sensitive data.

The ability for unauthenticated remote attackers to query the database directly poses a severe risk to data confidentiality. With a CVSS score of 7.5, this high-severity vulnerability could lead to the exposure of user credentials, personal information, or configuration details, potentially resulting in full site compromise or regulatory non-compliance.

Immediate Action: As no patched version is currently confirmed, administrators should immediately deactivate and uninstall the Fonts Manager | Custom Fonts plugin until a secure update is provided by the vendor.

Proactive Monitoring: Review database access logs for anomalous, time-delayed queries or unusual patterns associated with the fmcfIdSelectedFnt parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting WordPress plugin parameters.

Public Exploit Available: Unknown

Given the exposure of sensitive database information and the lack of an available patch, this vulnerability presents an unacceptable risk. Organizations must prioritize the removal of the affected plugin from their WordPress environments immediately to prevent potential data exfiltration.