CVE-2025-2932 JKDEVKIT <= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion

The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'fontuploadhandler' function in all versions up to, and including, 1.9.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delet...

CVE-2025-2932

CVE-2025-2932 (JKDEVKIT for WordPress) affects all versions up to 1.9.4 due to insufficient validation in the font_upload_handler, allowing an authenticated Subscriber+ attacker to delete arbitrary server files (e.g., wp-config.php). If WooCommerce is enabled, exploitation requires Contributor+ a...