JKDEVKIT WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the JKDEVKIT plugin for WordPress, affecting all versions through 1.9.4. This issue arises from inadequate file path validation in the 'font_upload_handler' function. The vulnerability enables authenticated attackers with Subscriber-level access and above to delete arbitrary files on the server. Deleting certain files, such as wp-config.php, could lead to remote code execution. If WooCommerce is active, a minimum of Contributor-level access is required.

Impact

Exploitation of this vulnerability could result in unauthorized deletion of files on the server, potentially leading to remote code execution if a critical file is removed.