The TypeSquare Webfonts for ConoHa plugin performs a missing authorization check (CWE-862), allowing any authenticated WordPress user with subscriber privileges or higher to alter global font settings. By submitting a POST request to any wp-admin page the attacker can change critical parameters such as typesquare_auth, show_post_form, and typesquare_fonttheme. For specific fontThemeUseType values of 1 and 3, the plugin also omits nonce verification, creating a cross‑site request forgery vector that could be abused without user interaction.

WordPress sites running the TypeSquare Webfonts for ConoHa plugin version 2.0.4 or earlier are affected. The vulnerability applies to all installations of these versions, regardless of whether the site uses the default subscriber role or an elevated user level.

The CVSS score of 4.3 indicates moderate severity; the EPSS score is not available, suggesting the exploitation probability is presently undefined but likely low. The vulnerability is not listed in the CISA KEV catalog. Attackers require authenticated access as a subscriber or higher; once authenticated, they can modify site-wide font settings via any admin page and, when using values 1 or 3, can perform CSRF attacks. The risk escalates on sites where font changes could affect branding, user trust, or content presentation.