The EmailKit plugin for WordPress is vulnerable to arbitrary file read through a flaw in the create_template() method of the CheckForm class. In PHP 8.x a realpath() call on the base directory can return false when the directory does not exist, which is then misinterpreted by a strpos comparison that erroneously allows the path to pass validation. An attacker with Author-level or higher access can supply an absolute path to the emailkit-editor-template REST API parameter and read any file readable by the web server, including sensitive configuration files such as wp-config.php. This weakness is identified as CWE-22, Path Traversal.

The vulnerability affects all WordPress installations that have installed the EmailKit plugin (roxnor:EmailKit – Email Customizer for WooCommerce & WP) with a version of 1.6.5 or earlier. No specific additional product or version details beyond the plugin name and the upper bound of 1.6.5 are available.

The overall risk is a moderate CVSS score of 6.5. EPSS data is not available, and the issue is not listed in CISA’s KEV catalog. The exploitation path is web-based, utilizing the emailkit‑editor‑template REST endpoint, and requires that the attacker be authenticated with at least Author privileges. Successful exploitation leads to disclosure of any file readable by the web server, potentially compromising confidentiality, enabling credential exposure, or paving the way for subsequent attacks. While the impact is limited to authenticated users, the ability to read sensitive files can be highly consequential.