Template Kit – Import plugin versions 1.0.16 and earlier allow deletion of any file on the WordPress server when the import process receives unvalidated file paths, a flaw classified as CWE‑22. An attacker who can trigger the import endpoint may remove critical configuration or content files, compromising the integrity and availability of the site.

The WordPress Plugin 'Template Kit – Import' from the vendor Envato is impacted. All releases up to and including version 1.0.16 are vulnerable. This plugin is used to import design templates into WordPress sites.

The flaw has a CVSS score of 6.8, placing it in the medium severity range. No EPSS score is published, so exploit probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying no documented mass exploitation. The likely attack vector requires access to the plugin’s import interface, typically via the WordPress admin area or an exposed import URL, therefore the attacker must be authenticated or otherwise able to reach that endpoint.