The EmailKit – Email Customizer for WooCommerce & WP plugin contains a path traversal flaw in the TemplateData endpoint. The action() function accepts the 'emailkit-editor-template' REST API parameter and passes it directly to file_get_contents() without validating or restricting the path. An authenticated user with Administrator privileges can supply a traversal string to read any file viewable by the web server, such as /etc/passwd or wp‑config.php, and the contents are stored as post meta for later retrieval. This results in a confidentiality breach of arbitrary files on the server, and it is identified by CWE‑22.

The vulnerability affects the EmailKit plugin from roxnor, used with WooCommerce and WordPress. All releases up to and including 1.6.3 are impacted, while newer releases are presumed fixed.

With a CVSS score of 4.9, the severity is moderate. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. Attack requires authenticated access to the REST API endpoint and an Administrator role, making the exploit more constrained compared to unauthenticated attacks. Nonetheless, the ability to read arbitrary files poses significant risk to confidentiality in compromised sites.