The JKDEVKIT plugin for WordPress allows authenticated users with Subscriber‑level access or higher to delete arbitrary files on the server because the font_upload_handler function does not validate the supplied file path. This flaw, identified as a path traversal error (CWE-22), can be used to remove critical WordPress files such as wp-config.php, enabling attackers to execute malicious code. If WooCommerce is active, the required privilege rises to Contributor‑level, but the severity remains high.

All WordPress installations running JKDEVKIT plugin version 1.9.4 or older are affected. The plugin is distributed through the WordPress plugin repository under the name JKDEVKIT and can be installed on any WordPress site with a user account structure.

The CVSS base score of 8.8 indicates high severity, and the EPSS score of 3% shows a low but measurable likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate to the site with Subscriber‑level or higher privileges (or Contributor‑level if WooCommerce is enabled) to trigger the deletion, after which the attacker can target any file in the server’s file system, potentially leading to data loss, service disruption, or remote code execution if critical files are removed or replaced.