CVE-2025-14351: Brainstormforce Custom Fonts – Host Your Fonts Locally

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google_Fonts_Compatibility' class constructor function in all versions up to, and including, 2.1.16. This makes it possible for unauthenticated attackers to delete font directory and rewrite theme.json file.

Affected products

• Brainstormforce Custom Fonts – Host Your Fonts Locally: up to and including 2.1.16

Published 2026-01-20. Last modified 2026-06-17.