Read the docs
TI-2021-06922 Aliases CVE-2021-24639GHSA-9w5p-x556-4j8v

OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion

Priority LOW 37CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Tampering, Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.

Summary

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.

Why it matters now

EPSS 0.00912 60th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed OMGF | Host Google Fonts Locally (Unknown): 4.5.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownOMGF | Host Google Fonts Locally4.5.4 to before 4.5.44.5.4Patch availableCNA
  • OMGF | Host Google Fonts Locally VendorUnknown Affected 4.5.4 to before 4.5.4 Fixed in 4.5.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ffw:omgf:*:*:*:*:*:wordpress:*:*before 4.5.4VulnerableFfw
  • cpe:2.3:a:ffw:omgf:*:*:*:*:*:wordpress:*:* Versions before 4.5.4 Vulnerable ·Ffw

Remediation

  • Fix · CNA OMGF | Host Google Fonts Locally (Unknown) Fixed in 4.5.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OMGF | Host Google Fonts Locally 4.5.4

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-06921 OMGF < 4.5.4 - Unauthenticated Path Traversal in REST APIPriority MEDIUM 43
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24639
  2. 2026-10-03 Alias added: GHSA-9w5p-x556-4j8v

References

Exploit 1

  • TI-2021-06921 OMGF < 4.5.4 - Unauthenticated Path Traversal in REST API CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences