Executive brief
A critical security flaw exists in OMGF Pro, a WordPress plugin used to optimize and host Google Fonts locally for performance and privacy. An attacker can upload malicious files directly to the web server without needing any login credentials. This could allow a complete takeover of the website, leading to data theft, site defacement, or the installation of persistent backdoors.
Technical details
The OMGF Pro plugin for WordPress is vulnerable to an unrestricted file upload (CWE-434) in versions up to and including 5.2.6. The vulnerability allows an unauthenticated remote attacker to upload files with dangerous extensions (such as .php) to the server. This occurs due to a lack of proper file type validation and authorization checks in the file upload component. Successful exploitation enables the attacker to execute arbitrary code in the context of the web server, leading to a full compromise of the host. The issue is resolved in version 5.2.7.
Affected products
- Daan.dev OMGF Pro up to 5.2.6
Timeline
- 2026-06-25: disclosed: Reported by NETZLICHT via Patchstack
- 2026-06-25: advisory
- 2026-06-25: patched: Fixed in version 5.2.7