CVE-2025-2932: JKDEVKIT WordPress Path Traversal Flaw

CVE-2025-2932 Overview

CVE-2025-2932 is an arbitrary file deletion vulnerability in the JKDEVKIT plugin for WordPress. The flaw exists in the font_upload_handler function and affects all plugin versions up to and including 1.9.4. Insufficient file path validation allows authenticated users with Subscriber-level access to delete arbitrary files on the server. When WooCommerce is enabled, the required privilege rises to Contributor-level. Deleting sensitive files such as wp-config.php can trigger WordPress reinstallation routines and lead to remote code execution. The issue is classified under CWE-22 (Path Traversal).

Critical Impact
Authenticated low-privilege attackers can delete arbitrary files on the WordPress server, including wp-config.php, enabling site takeover and remote code execution.

Affected Products

JKDEVKIT plugin for WordPress, versions up to and including 1.9.4
WordPress installations with JKDEVKIT enabled and Subscriber-or-above registration permitted
WordPress installations with JKDEVKIT and WooCommerce enabled (Contributor-or-above accounts)

Discovery Timeline

2025-07-03 - CVE-2025-2932 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2932

Vulnerability Analysis

The vulnerability resides in the font_upload_handler function within the JKDEVKIT plugin's fonts manager module. The function accepts user-controlled input that is used to construct a file path for deletion operations without proper validation or sanitization. An authenticated attacker can supply a crafted path traversal sequence to reference files outside the intended font upload directory.

Because WordPress assigns Subscriber capabilities to any registered user on sites that allow open registration, the privilege requirement is low. On sites running WooCommerce, the plugin's capability checks elevate the requirement to Contributor, which is still a low-trust role frequently granted to external content creators.

The most consequential exploitation path involves deleting wp-config.php. When WordPress cannot locate this file, it enters the installation wizard, allowing an attacker to reconnect the site to an attacker-controlled database and seize administrative access, ultimately yielding remote code execution.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. The font_upload_handler function does not canonicalize the supplied path or verify that the resolved path remains within the plugin's intended font storage directory before invoking deletion routines.

Attack Vector

The attack vector is remote and network-based over HTTP(S). An attacker authenticates to WordPress, sends a crafted request to the AJAX endpoint that invokes font_upload_handler, and supplies a relative path traversal payload pointing to a target file. The server resolves the path and unlinks the file. See the Wordfence Vulnerability Report for technical details on the vulnerable handler.

No verified public exploit code is available. The vulnerability can be described in prose: the handler receives a filename parameter, concatenates it with a base directory path, and calls a file deletion function without first validating that the resolved canonical path stays within the allowed directory.

Detection Methods for CVE-2025-2932

Indicators of Compromise

Missing or unexpectedly recreated wp-config.php, .htaccess, or core WordPress files
HTTP POST requests to WordPress AJAX endpoints (admin-ajax.php) referencing JKDEVKIT font upload actions with ../ sequences in parameters
WordPress error logs showing file_not_found conditions for previously valid plugin or theme files
Sudden appearance of the WordPress installation wizard at the site root

Detection Strategies

Inspect web server access logs for requests containing path traversal patterns directed at JKDEVKIT endpoints
Monitor file integrity for critical WordPress files including wp-config.php, index.php, and active theme functions.php
Correlate authentication events for Subscriber or Contributor accounts with subsequent plugin AJAX requests

Monitoring Recommendations

Enable WordPress audit logging for user role assignments and plugin activity
Forward web server and PHP logs to a centralized SIEM for retention and query
Alert on any deletion of files matching wp-config*, *.php outside of plugin update windows
Track anomalous traffic to admin-ajax.php with parameters containing .., %2e%2e, or absolute path prefixes

How to Mitigate CVE-2025-2932

Immediate Actions Required

Update the JKDEVKIT plugin to a version newer than 1.9.4 as soon as a patched release is available from the vendor
Disable the JKDEVKIT plugin on production sites until a fixed version is deployed
Review and remove untrusted Subscriber and Contributor accounts, and disable open user registration where not required
Back up wp-config.php and core WordPress files to a location outside the web root

Patch Information

Reference the Wordfence Vulnerability Report for current patch availability. Administrators should monitor the WordPress.org plugin repository for JKDEVKIT releases above version 1.9.4 that address the font_upload_handler validation flaw.

Workarounds

Restrict access to admin-ajax.php JKDEVKIT actions via a web application firewall rule that blocks path traversal characters in request parameters
Set filesystem permissions so the PHP process user cannot delete wp-config.php or other core files
Require multi-factor authentication for all WordPress accounts to raise the cost of credential-based access
Temporarily deactivate the plugin and remove its files from wp-content/plugins/jkdevkit/ if patching is not immediately feasible

bash

# Example WAF rule pattern to block path traversal in JKDEVKIT requests
# (adapt to your WAF syntax - ModSecurity example shown)
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,deny,status:403,id:1002932,msg:'CVE-2025-2932 JKDEVKIT path traversal'"
  SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e)" "t:lowercase,t:urlDecodeUni"