The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion because the font_upload_handler function does not properly validate the file path supplied by a user. An authenticated user with Subscriber‑level or higher privileges can instruct the plugin to delete any file within the server’s file system. The flaw is a classic path traversal (CWE‑22) that can be leveraged to remove critical WordPress configuration files, such as wp‑config.php, thereby enabling remote code execution. If WooCommerce is active, the attacker must have at least Contributor‑level access to perform the deletion, but the overall risk remains significant.

WordPress sites running JKDEVKIT v1.9.4 or earlier are affected. The plugin is distributed as a WordPress plugin named "JKDEVKIT" and can be installed on any WordPress instance with a database and user accounts.

The CVSS base score of 8.8 indicates high severity and the EPSS score of 1% suggests a very low but nonzero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. In practice, an attacker would need access to a WordPress account with authenticated Subscriber (or higher) privileges, which is a limitation that narrows the attack vector to legitimate–looking traffic. Nonetheless, the ability to delete arbitrary files can enable data loss, denial of service, or the execution of malicious code if critical files are removed or replaced.