The vulnerability is a Cross‑Site Request Forgery (CWE‑352) in the CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts WordPress plugin. It arises from missing or incorrect nonce validation in the cits_settings_tab() function. As a result, an unauthenticated attacker who forges a request can cause the browser of a logged‑in site administrator to modify the plugin’s configuration settings. The changes affect how media files and custom fonts are handled by the plugin, but the vulnerability does not expose confidential data or grant direct code execution.

All releases of the CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts plugin up to and including version 4.2 are vulnerable on any WordPress installation. Sites that rely on this plugin for media management and custom font handling must be assessed for the presence of these versions.

The CVSS score of 4.3 indicates a moderate severity. An EPSS score of less than 1% suggests a low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated attacker to trick a site administrator into following a malicious link or form submission, which is a social engineering vector. While the attack is limited to changing plugin settings, the change can affect site appearance and media handling, which could be undesirable for high‑traffic or high‑value sites.