Technical impact
The vulnerability resides in the EmailKit plugin’s REST API endpoint create_template, where the emailkit‑editor‑template parameter is passed directly to file_get_contents() without validation. This omission allows an authenticated user with Author-level or higher permissions to include a crafted path that resolves to arbitrary files on the server, such as /etc/passwd or wp-config.php. The attacker’s ability to read these files amounts to a confidentiality breach, exposing sensitive configuration data and potentially credentials. The weakness is identified as Path Traversal (CWE‑73).
Affected Systems
Any WordPress site using the EmailKit – Email Customizer for WooCommerce & WP plugin, versions up to and including 1.6.1. The issue affects all installations of the plugin where the create_template endpoint is active.
Risk and Exploitability
With a CVSS score of 6.5 the vulnerability is considered moderate severity. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating that, while the risk of exploitation is currently low, it remains realistic for victims who have authorized authorship access. An attacker would need only normal author privileges to send a crafted request to the REST API, read any file the web server can access, and exfiltrate the contents via post meta saved in the plugin’s database. The potential impact is limited to confidentiality loss of server files but could enable further attacks if sensitive files are accessed.
