Unauthorized Data Deletion in Borderless Plugin for WordPress by Plugin Vendor

CVE-2024-11583

What is CVE-2024-11583?

The Borderless plugin for WordPress is susceptible to a security flaw that allows authenticated users with Subscriber-level access and above to delete uploaded icon fonts. This vulnerability arises from a lack of proper capability checks in the 'remove_zipped_font' function, potentially leading to the loss of critical design assets for websites relying on this tool. Site administrators should be aware of this issue and take immediate measures to secure their installations, including updating to the latest version or applying relevant patches.

References