CVE-2025-2932

CVE-2025-2932 (JKDEVKIT for WordPress) affects all versions up to 1.9.4 due to insufficient validation in the font_upload_handler, allowing an authenticated Subscriber+ attacker to delete arbitrary server files (e.g., wp-config.php). If WooCommerce is enabled, exploitation requires Contributor+ a...

CVE-2025-2932 JKDEVKIT <= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion

The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'fontuploadhandler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delet...

WordPress plugin JKDEVKIT 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2025-2932: Improper Limitation of a Pathname to a Restricted Directory

The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'fontuploadhandler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delet...