CVE-2025-2932

CVE-2025-2932 (JKDEVKIT for WordPress) affects all versions up to 1.9.4 due to insufficient validation in the font_upload_handler, allowing an authenticated Subscriber+ attacker to delete arbitrary server files (e.g., wp-config.php). If WooCommerce is enabled, exploitation requires Contributor+ a...