着陆页字体配对预览 <= 1.3 - 跨站请求伪造导致设置更新

Successful exploitation of this CSRF vulnerability allows an attacker to silently alter the plugin's configuration without requiring authentication. This could lead to unexpected changes in the website's appearance or functionality, potentially impacting user experience and branding. An attacker could craft a malicious link or embed a hidden form on a compromised website to trigger the forged request when a site administrator visits the page. While the direct impact might seem limited to font pairings, it demonstrates a fundamental security weakness that could be leveraged for further attacks if the plugin has other vulnerabilities.

WordPress websites utilizing the Font Pairing Preview For Landing Pages plugin, particularly those with site administrators who frequently click on links from untrusted sources, are at risk. Shared hosting environments where multiple websites share the same server resources are also potentially vulnerable if one site is compromised.

• wordpress / composer / npm:

grep -r 'settings_update' /var/www/html/wp-content/plugins/font-pairing-preview-for-landing-pages/

• generic web:

curl -I https://example.com/wp-admin/admin-post.php?action=font_pairing_preview_settings_update&setting1=value1&setting2=value2 # Check for missing nonce

1. 2026-03-07Disclosure

   disclosure

1. 已保留2026-01-16
2. 发布日期2026-03-07
3. 修改日期2026-04-08
4. EPSS 更新日期2026-03-23

The primary mitigation is to upgrade to a patched version of the Font Pairing Preview For Landing Pages plugin as soon as it becomes available. Until an upgrade is possible, implement a temporary workaround by adding nonce validation to the settings update functionality. This will prevent forged requests from being processed. Additionally, restrict access to the plugin's settings page to authorized administrators only. Regularly review plugin settings for any unauthorized modifications. After upgrade, confirm by verifying the settings page requires authentication and nonce validation.