Cross-Site Request Forgery Vulnerability in Zegen Core Plugin for WordPress

CVE-2025-11087

What is CVE-2025-11087?

The Zegen Core plugin for WordPress is exposed to a Cross-Site Request Forgery vulnerability that allows unauthorized file uploads due to insufficient nonce validation and file type checks in the '/custom-font-code/custom-fonts-uploads.php' file. This vulnerability can be exploited by attackers to upload arbitrary files to the server, potentially facilitating remote code execution, especially if they can deceive a site administrator into triggering the upload through a malicious link.

References