CVE-2023-5860 in Icons Font Loader Plugin
Summary
by MITRE • 11/02/2023
The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions up to, and including, 1.1.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 04/11/2026
The CVE-2023-5860 vulnerability affects the Icons Font Loader plugin for WordPress, representing a critical security flaw that enables authenticated attackers with administrator privileges to execute arbitrary file uploads on affected systems. This vulnerability exists within the plugin's upload function where proper file type validation mechanisms are completely absent, creating a pathway for malicious actors to bypass security controls that should prevent unauthorized file operations. The issue impacts all versions of the plugin up to and including version 1.1.2, making it a widespread concern for WordPress administrators who have not yet updated their installations.
The technical implementation of this vulnerability stems from a fundamental lack of input validation within the plugin's file upload functionality. When administrators or users with sufficient privileges attempt to upload font files through the plugin interface, the system fails to properly validate the file extensions, MIME types, or file content against established security parameters. This absence of validation creates an exploitable condition where attackers can upload files with potentially malicious extensions such as .php, .jsp, or other server-side script formats that could execute code on the web server. The vulnerability directly maps to CWE-434, which describes the weakness of unrestricted file upload, and represents a classic example of insufficient input validation that allows attackers to bypass security controls through improper file handling.
The operational impact of this vulnerability is severe and potentially devastating for affected WordPress installations. An attacker with administrator-level access can leverage this flaw to upload malicious files that may lead to complete system compromise, including remote code execution capabilities that could allow for persistent backdoor access, data exfiltration, or further network infiltration. The attack vector requires only authenticated access, meaning that once an attacker has obtained administrative credentials through phishing, credential stuffing, or other means, they can immediately exploit this vulnerability without additional prerequisites. This makes the vulnerability particularly dangerous in environments where administrative accounts may be compromised through social engineering attacks or weak authentication practices.
Organizations affected by CVE-2023-5860 should implement immediate mitigations including updating to the latest version of the Icons Font Loader plugin where the file validation issues have been addressed. System administrators should also consider implementing additional security measures such as restricting file upload capabilities to specific directories with proper access controls, implementing web application firewalls that can detect and block suspicious file upload attempts, and conducting thorough security audits of all installed WordPress plugins. The ATT&CK framework categorizes this vulnerability under T1190 - Exploit Public-Facing Application, highlighting how attackers can leverage known vulnerabilities in web applications to establish initial access. Additionally, implementing principle of least privilege access controls and regular security monitoring can help detect unauthorized file upload activities that may indicate exploitation attempts. Organizations should also consider deploying automated vulnerability scanning tools that can identify outdated plugins and potential exploitation vectors within their WordPress environments to prevent successful exploitation of this and similar vulnerabilities.