CVE-2025-2932: 
WordPress vulnerability analysis and mitigation

CVE-2025-2932 is an arbitrary file deletion vulnerability in the JKDEVKIT plugin for WordPress, caused by insufficient file path validation in the font_upload_handler function. It affects all versions of the plugin up to and including 1.9.4. Authenticated attackers with Subscriber-level access (or Contributor-level if WooCommerce is enabled) can exploit this flaw to delete arbitrary files on the server, potentially leading to remote code execution. It carries a CVSS v3.1 base score of 8.8 (High) and was published on July 3, 2025 (Wordfence, Red Hat CVE).

The root cause is a path traversal vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) in the font_upload_handler function located in inc/modules/fonts_manager.php of the JKDEVKIT plugin. Due to insufficient validation of user-supplied file paths, an authenticated attacker can craft a request that traverses outside the intended directory and targets arbitrary files for deletion. Deleting critical WordPress files such as wp-config.php can trigger WordPress's installation mode, enabling an attacker to reconfigure the site and achieve remote code execution. The attack requires no user interaction and has low attack complexity (Wordfence, ENISA EUVD).

Successful exploitation allows an attacker to delete any file accessible to the web server process, with high impacts on confidentiality, integrity, and availability. The most critical scenario involves deleting wp-config.php, which removes the database configuration and forces WordPress into setup mode — enabling an attacker to reconnect the site to an attacker-controlled database and achieve full remote code execution. This can result in complete site takeover, data exfiltration, and persistent backdoor installation (Wordfence, ENISA EUVD).

As of the time of reporting, no public proof-of-concept exploit code has been identified and there is no evidence of active in-the-wild exploitation (Wordfence). The vulnerability has an EPSS score of approximately 0.325%, indicating a relatively low (but non-negligible) probability of exploitation in the near term. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low privilege requirement (Subscriber-level) makes this accessible to a broad range of potential attackers on sites with open registration.

1. Reconnaissance: Identify WordPress sites running the JKDEVKIT plugin (version ≤ 1.9.4) using tools like WPScan or by checking plugin metadata at /wp-content/plugins/jkdevkit/readme.txt.
2. Obtain low-privilege access: Register or obtain credentials for a Subscriber-level account (or Contributor-level if WooCommerce is active) on the target WordPress site.
3. Craft malicious request: Send an authenticated HTTP request to the endpoint that invokes font_upload_handler, supplying a path-traversal payload (e.g., ../../wp-config.php) as the file path parameter to target a critical file.
4. Trigger file deletion: Submit the crafted request; the plugin's insufficient path validation allows the server to delete the specified file outside the intended upload directory.
5. Achieve remote code execution: With wp-config.php deleted, navigate to the WordPress installation wizard (/wp-admin/setup-config.php), connect the site to an attacker-controlled database, and gain administrative access — enabling arbitrary PHP execution or web shell upload (Wordfence, ENISA EUVD).

• Logs: Web server access logs showing authenticated POST requests to the JKDEVKIT font upload handler endpoint (/wp-admin/admin-ajax.php or similar) with path traversal sequences (../, %2e%2e%2f) in parameters.
• File System: Unexpected absence of critical WordPress files such as wp-config.php, .htaccess, or core plugin/theme files; presence of new or unfamiliar PHP files in the WordPress root or wp-content directory.
• Logs: WordPress debug logs or PHP error logs showing file deletion operations originating from fonts_manager.php.
• Network: Requests to /wp-admin/setup-config.php or the WordPress installation wizard from unexpected IP addresses following file deletion events.
• Process: Unusual database connection attempts or new WordPress admin accounts created shortly after the deletion event.

The primary remediation is to update the JKDEVKIT plugin to a version beyond 1.9.4 as soon as a patched release is available from the vendor (jkdevstudio). In the interim, site administrators should restrict plugin access to trusted users with the minimum necessary privileges and disable open user registration if not required. Additional hardening measures include implementing file system access controls to prevent the web server from deleting critical files, maintaining regular backups of all site files and the database, and monitoring for unexpected file deletions or access to the WordPress setup wizard (Wordfence, ENISA EUVD).

Wordfence, which assigned and disclosed this CVE, included it in their weekly WordPress vulnerability report for the period of June 30 – July 6, 2025 (Wordfence Weekly Report). The vulnerability was also referenced in the CISA vulnerability bulletin for the week of June 30, 2025 (CISA Bulletin). Community discussion has been limited, with brief mentions on security-focused Mastodon accounts and aggregator platforms, reflecting the moderate-to-high severity but lack of active exploitation at this time.