Template Kit Import EUVD-2026-89877

Requires an authenticated WordPress session with at least Editor-level privileges on a site running the Template Kit - Import plugin version 1.0.16 or earlier; the CVSS encodes PR:H, though the description's reference to the Editor role suggests the practical bar is a mid-tier content account rather than an administrator. No user interaction is needed (UI:N) and the vector is network-based (AV:N/AC:L). Exploitation is limited by the need for a pre-existing privileged account, so risk is concentrated on multi-author, agency, or membership sites that grant Editor rights to less-trusted users; the impact is availability/file-integrity of the host filesystem (arbitrary deletion), not data disclosure.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H, base 6.8) describes a network-reachable, low-complexity flaw with no user interaction, whose only impact is availability (A:H) via arbitrary file deletion, and a scope change (S:C) reflecting that deleted files can lie outside the plugin's security scope (e.g. core WordPress files or OS-level files). There is no confidentiality or integrity impact recorded. Critically, the description attributes the capability to an 'Editor' role, but the vector encodes PR:H (high privileges); in the WordPress role model an Editor is a mid-tier content role, not an administrator, so PR:H appears too strict and PR:L is the more defensible mapping - this would raise the real base score to roughly 8.7 and materially changes prioritization, so the privilege metric should be verified against the Patchstack advisory. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' Net: this is an authenticated-only, availability-only issue whose real-world risk hinges on how many low-trust Editor accounts exist on a given site; it is a genuine site-availability/tamper concern for multi-author installs but is not a mass-exploitation candidate absent public exploit code or KEV evidence.

An attacker who holds (or phishes/compromises) a WordPress Editor account on a site running Template Kit - Import <= 1.0.16 sends a crafted request to the plugin's import/handling endpoint supplying a traversal path, causing the plugin to delete an arbitrary file on the server. By removing critical files (for example wp-config.php or core includes), the attacker breaks or takes the site offline. No public exploit code is identified in the supplied data, and exploitation requires an existing authenticated Editor-level session.