What is the CVSS score of CVE-2026-5957?

CVE-2026-5957 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

EmailKit WordPress Plugin CVE-2026-5957

EUVD-2026-27197 MEDIUM

Path Traversal (CWE-22)

2026-05-05 Wordfence

GHSA-28j2-6q62-7r48

PHP WordPress Path Traversal

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 04:31 vuln.today

DescriptionCVE.org

The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to and including 1.6.5. This is due to a flawed path traversal validation in the create_template() method of the CheckForm class, where realpath() is called on the allowed base directory (wp-content/uploads/emailkit/templates/) which may not exist, causing it to return false. In PHP 8.x, strpos($real_path, false) implicitly converts false to an empty string, and strpos() with an empty needle always returns 0, causing the check strpos(...) !== 0 to evaluate to false and bypassing the path validation entirely. This makes it possible for authenticated attackers, with Author-level access and above, to read arbitrary files from the server, including sensitive files such as wp-config.php, by supplying an absolute path to the emailkit-editor-template REST API parameter.

AnalysisAI

EmailKit plugin for WordPress versions up to 1.6.5 allows authenticated attackers with Author-level access to read arbitrary files from the server due to a path traversal vulnerability in the create_template() method. The vulnerability exploits a PHP 8.x type coercion flaw where realpath() returns false for non-existent directories, causing strpos() validation to incorrectly evaluate and bypass directory restrictions. Attackers can retrieve sensitive files such as wp-config.php by submitting absolute paths via the emailkit-editor-template REST API parameter. No public exploit code identified at time of analysis, though the vulnerability mechanism is trivial to weaponize once authentication is obtained.

Technical ContextAI

The vulnerability resides in the CheckForm class's create_template() method, which validates file paths before allowing template operations. The flawed logic calls realpath() on the base directory wp-content/uploads/emailkit/templates/ without checking if this directory exists. In PHP 8.x, when realpath() returns false (indicating the path does not exist), the subsequent strpos($real_path, false) operation triggers an implicit type coercion converting false to an empty string. The function strpos() with an empty string as the needle parameter always returns 0 (the position of the empty substring at the start). The validation logic strpos($real_path, 0) !== 0 then evaluates to false, bypassing the intended directory containment check. This is a classic path traversal vulnerability (CWE-22) combined with a PHP version-specific type juggling flaw. The REST API endpoint emailkit-editor-template processes user-supplied paths without proper normalization after the failed validation, allowing traversal sequences (e.g., absolute paths or ../ sequences) to access files outside the intended templates directory.

RemediationAI

Update the EmailKit plugin to a version released after 1.6.5 immediately; the exact fixed version number is not confirmed in the available data, but vendor updates addressing this path traversal flaw should be available via the WordPress Plugin Directory or the plugin's update mechanism. The core fix requires modification of the create_template() method in the CheckForm class to properly validate that the base templates directory exists before calling realpath(), and to ensure that any user-supplied path is normalized and verified to reside within the intended directory using robust comparison logic (e.g., comparing canonical paths with array checks rather than strpos()). Until a patched version is deployed, restrict Author-level and Editor-level access to only trusted users, and consider temporarily deactivating the EmailKit plugin if not actively in use. Web application firewalls or reverse proxies can be configured to block requests to the emailkit-editor-template REST endpoint that contain absolute paths or traversal sequences (../, encoded variations), though this is a temporary control and does not address the underlying vulnerability. Database backups should be taken before deploying the update to mitigate potential data loss during patching. Verify that wp-config.php and other sensitive files have not been accessed by reviewing web server access logs and database query logs for unusual activity following the update.