Summary
The Font Library font-family value crosses into subsite-wide Global Styles CSS without sufficient delimiting/validation. A lower-privilege authenticated user can influence rendered CSS beyond the intended font declaration.
Affected Products
WordPress core 7.0.4; Font Library and Global Styles.
Affected Scope
- Product
- WordPress
- Component
- Font Library / Global Styles CSS serialization
- Affected function
- Font-family registration and Global Styles stylesheet generation; fontFamily input
- Affected versions
- WordPress 7.0.4 (revalidated). Earlier/fixed versions are not asserted without a pinned vendor confirmation.
- Safe version
- No fixed version confirmed in the supplied material.
- CWE
- CWE-20; CWE-79 (stored CSS/markup injection boundary, if rendered as markup)
Technical Summary
A caller-controlled fontFamily value is reused in generated Global Styles CSS without a strict font-family grammar, so a crafted value can escape its intended declaration. The public proof is bounded to a visible style change.
Prerequisites and Permissions
Authenticated user with the documented Font Library write path; no administrator-only capability is assumed beyond the supplied test setup.
Affected Locations
WordPress Font Library implementation; Global Styles/theme.json fontFamily serialization; fontFamily parameter/property. Exact line numbers were not supplied and are not invented.
Reproducible Proof
A controlled Font Library entry caused the generated site-wide stylesheet to contain the attacker-controlled style effect. The payload and any chained use are withheld.
Vulnerable Code
$font_family = $preset[&class="tok-comment">#39;fontFamily'];
$css .= $selector . &class="tok-comment">#39; { font-family: class="tok-string">' . $font_family . '; }';Severity
high
Technical Analysis
Font Library data is accepted as a font-family/style value and later incorporated into the Global Styles stylesheet. The value is not constrained to the intended font-family grammar before CSS serialization, allowing a declaration-boundary breakout.
Impact
Integrity impact: site-wide presentation can be altered for visitors and privileged users. No script execution, credential disclosure, or server-side execution is claimed.
Remediation
Treat font-family as a structured token/list, reject CSS delimiters and control characters, and encode/validate again at Global Styles serialization. Add tests for Font Library values crossing CSS declaration boundaries.
Timeline
- Published
- Advisory published
Credits
Reported by Aria Akhavan. Disclosure timeline: 2026-08-12 submission; 2026-09-07 follow-up; no response documented by 2026-09-14.