What the vulnerability does
01Description
The Zegen Core plugin for WordPress is vulnerable to Cross-Site Request Forgery to Arbitrary File Upload in versions up to, and including, 2.0.1. This is due to missing nonce validation and missing file type validation in the '/custom-font-code/custom-fonts-uploads.php' file. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Explanation of Vulnerability in Simple Terms
02Summary
Zegen Core versions up to 2.0.1 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious link or page that, when visited by an admin, executes unwanted changes to the site. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on the site by tricking an admin into visiting a malicious page.
Potential impact on your site
04Site Impact
Attackers can modify site settings, create accounts, delete content, or compromise the site without direct access.
Conditions required to exploit
05Prerequisites
An administrator must visit a malicious link or page while logged in to the site.
Key dates
06Disclosure timeline
November 21, 2025
CVE published
April 8, 2026
Record updated
