CVE-2026-96824: WordPress Template Kit – Import plugin <= 1.0.16 - Arbitrary File Deletion vulnerability
Published Sep 30, 2026
·Updated
Editor Arbitrary File Deletion in Template Kit – Import <= 1.0.16 versions.
Affected Software
1 affected component
WordPress Template Kit – Import<=1.0.16
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Template Kit – Import Pluginto a version that resolves this vulnerability.Fixed in 1.0.17
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must already have high privileges in the affected environment. Exploitation is network-accessible, has low attack complexity, and does not require user interaction.
2
What is the expected security impact?
The reported impact is high availability impact through arbitrary file deletion. The supplied vector reports no confidentiality or integrity impact.
3
Which installations should be prioritized for review?
WordPress sites using Template Kit – Import version 1.0.16 or earlier are identified as affected. The provided data does not specify a fixed version or a workaround.