What the vulnerability does
01Description
The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from the emailkit-editor-template parameter is passed directly to file_get_contents() without sanitization. This makes it possible for authenticated attackers with Author-level permissions or higher to read arbitrary files on the server, including sensitive configuration files like /etc/passwd and wp-config.php, via the REST API. The file contents are stored in post meta and can be exfiltrated through MetForm's email confirmation feature.
Explanation of Vulnerability in Simple Terms
02Summary
EmailKit for WooCommerce & WordPress contains an external input validation flaw that allows authenticated users with low privileges to read sensitive data. The vulnerability affects versions up to 1.6.1. An attacker with a standard user account can access confidential information without modifying data or disrupting service. Update to a version newer than 1.6.1 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Read sensitive data accessible through the plugin without needing admin privileges.
Potential impact on your site
04Site Impact
Any registered user can access confidential information stored or processed by EmailKit.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the WordPress site; no user interaction required.
Key dates
06Disclosure timeline
January 7, 2026
CVE published
April 8, 2026
Record updated
