Fonto – Custom Web Fonts Manager Security & Risk Analysis

The Fonto plugin v1.2.2 exhibits a mixed security posture. While it demonstrates good practices in certain areas, such as using prepared statements for all SQL queries and a high percentage of properly escaped output, significant concerns remain. The presence of two unprotected AJAX handlers creates a substantial attack surface that could be exploited by unauthenticated users. The plugin's vulnerability history is particularly concerning, with two previously disclosed medium-severity vulnerabilities, one of which remains unpatched. These past vulnerabilities, specifically Path Traversal and Cross-site Scripting, indicate a recurring pattern of insecure input handling, which is further suggested by the high percentage of unescaped output and the lack of capability checks on its entry points.

The static analysis reveals two unprotected AJAX handlers, which are direct entry points without authentication. This is a critical oversight. The absence of capability checks on any of the entry points means that even if authentication were present, authorization is not being enforced. Furthermore, the bundled TinyMCE library, while not explicitly flagged as outdated in this analysis, represents a potential risk if it is an older, vulnerable version. The taint analysis showing zero flows with unsanitized paths is a positive sign, suggesting that known path traversal vectors might have been addressed in this version, but the historical pattern of such vulnerabilities should not be ignored.

In conclusion, Fonto v1.2.2 has strengths in its handling of database queries and output sanitization. However, the unprotected AJAX endpoints and the unpatched medium-severity vulnerability from its history represent significant risks. The recurring types of past vulnerabilities (Path Traversal, XSS) and the lack of capability checks are red flags that warrant immediate attention. The plugin's overall security is compromised by these factors, making it a potentially risky component for any WordPress installation.