CVE-2025-2932 in JKDEVKIT Plugin
Summary
by MITRE • 07/03/2025
The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). If WooCommerce is enabled, attackers will need Contributor-level access and above.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/29/2026
The JKDEVKIT plugin for WordPress presents a critical security vulnerability through its inadequate input validation mechanisms within the font_upload_handler function, affecting all versions up to and including 1.9.4. This flaw stems from insufficient sanitization of file paths during the font upload process, creating an arbitrary file deletion vulnerability that can be exploited by authenticated attackers. The vulnerability manifests when user-supplied file path data is directly processed without proper validation or filtering, allowing malicious actors to manipulate the system into deleting files beyond the intended scope of the upload functionality.
The technical exploitation of this vulnerability requires minimal privileges, with subscribers gaining access to the deletion capability while contributors and above can leverage it within WooCommerce environments. This privilege escalation pathway represents a significant concern as it allows attackers to target critical system files such as wp-config.php which contains database credentials and cryptographic keys essential for application security. The vulnerability aligns with CWE-22 - Improper Limitation of a Pathname to a Restricted Directory, specifically manifesting as path traversal issues where attacker-controlled input bypasses intended file access restrictions.
The operational impact of this vulnerability extends far beyond simple file deletion capabilities, as the potential for remote code execution becomes increasingly dangerous when attackers can target configuration files or core application components. The ability to delete wp-config.php would immediately compromise the entire WordPress installation by removing database connectivity information and security keys, potentially leading to complete system takeover. Security professionals should note that this vulnerability operates within the ATT&CK framework under T1059 - Command and Scripting Interpreter and T1486 - Data Encrypted for Impact, as it enables attackers to manipulate system files and potentially escalate privileges through strategic file removal operations.
Mitigation strategies must focus on immediate plugin updates to versions that address the path validation issues, though administrators should also implement additional protective measures including restricting user permissions where possible and monitoring file system changes for unauthorized deletions. The vulnerability demonstrates the critical importance of input validation in web applications and highlights how seemingly minor security oversights can create pathways for complete system compromise. Organizations should conduct comprehensive audits of their WordPress installations to identify other plugins with similar path traversal vulnerabilities, as this represents a common pattern in poorly secured file handling functions within content management systems.