EmailKit WordPress Plugin CVE-2026-5957

Exploitation requires the attacker to possess authenticated access at Author level or above within WordPress. The vulnerability is specific to PHP 8.x environments; sites running PHP 7.x or earlier are NOT vulnerable because the type coercion behavior (false converted to empty string in strpos()) does not occur in those versions. The base directory wp-content/uploads/emailkit/templates/ must not exist on the server (a reasonable assumption for many installations where this directory has not been created), triggering the realpath() false return that initiates the validation bypass. No special plugin configuration is required; the vulnerability is present in default installations. The attacker must be able to make HTTP requests to the WordPress REST API endpoint /wp-json/emailkit/v1/create-template, which is publicly accessible but requires valid authentication credentials. No user interaction is required beyond the initial API request.

The vulnerability presents a moderate-to-high real-world risk despite the authentication requirement. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly reflects that the attack requires network access, low complexity exploitation, and low privileges (Author level), with high confidentiality impact but no integrity or availability impact. EPSS data is not provided in the input, preventing probabilistic exploitation assessment. The authentication requirement (PR:L) substantially limits the attack surface compared to unauthenticated vulnerabilities, as exploitation requires a compromised or legitimate Author account. However, the Author role is commonly held by contributors in multi-user WordPress installations, and account compromise (via password reuse, phishing, or other means) is a frequent attack vector. The path traversal mechanism is straightforward to exploit once authenticated, requiring only modification of a REST API parameter to an absolute path like /etc/passwd or /var/www/html/wp-config.php. The vulnerability affects all versions up to 1.6.5 with no evidence of older patched releases, indicating a long exposure window. The PHP 8.x-specific type coercion behavior means the vulnerability only manifests on PHP 8.0 and later, partially limiting impact to sites using older PHP versions, though WordPress hosting increasingly defaults to PHP 8.x. Risk is elevated because wp-config.php disclosure exposes database credentials and security keys, enabling full site compromise even without code execution. Remediation requires a plugin update, and no workarounds are documented.

An attacker with a compromised Author-level WordPress account (e.g., obtained via credential theft or social engineering) authenticates to the WordPress backend and submits a crafted POST request to the /wp-json/emailkit/v1/create-template REST endpoint with the emailkit-editor-template parameter set to an absolute path such as /var/www/html/wp-config.php. The create_template() method's flawed path validation (realpath() on a non-existent directory) permits the traversal, and the endpoint returns the contents of wp-config.php, which includes the database password and security keys. The attacker uses these credentials to access the WordPress database directly or authenticate as an administrator, escalating to full site compromise without requiring code execution.