CVE-2021-24639: OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-20 · updated 2026-06-17
Weakness: CWE-22

Description

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.

Affected products

OMGF | Host Google Fonts Locally: before 4.5.4 — fixed in 4.5.4

How to fix

Upgrade to a fixed version: OMGF | Host Google Fonts Locally 4.5.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/1ada2a96-32aa-4e37-809c-705db6026e0b
https://wpscan.com/vulnerability/1ada2a96-32aa-4e37-809c-705db6026e0b

Get alerted when CVE-2021-24639 or the next vulnerability affects your stack