EUVD-2026-13920Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | While the CVSS v3.1 score of 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) indicates moderate severity with high confidentiality impact but requiring Administrator privilege level, the real-world risk must be contextualized through the attack vector and privilege requirements. The vulnerability requires PR:H (high privileges – Administrator access), which significantly limits the threat actor pool in most WordPress installations. However, in multi-user WordPress environments, compromised administrator accounts, rogue agency administrators, or insider threats pose a credible risk. The attack is network-accessible with low complexity and requires no user interaction, making exploitation trivial once access is obtained. The presence of proof-of-concept code references in the WordPress plugin repository (evidenced by the changeset and multiple version comparisons) and Wordfence reporting suggest active research and potential POC availability. For organizations relying on multiple administrators or shared hosting scenarios, this represents a real information disclosure priority despite the privilege requirement. The lack of KEV/EPSS data in provided intelligence prevents full probabilistic assessment, but the technical maturity of the exploit and easy implementation suggest this should not be dismissed as low-priority despite moderate CVSS. |
| Exploit ScenarioDerived | A malicious or compromised WordPress administrator initiates an authenticated REST API request to the 'emailkit-editor-template' endpoint, supplying a traversal path such as '../../../../etc/passwd' or '../../../../wp-config.php' in the request parameter. The TemplateData class's action() function directly passes this unsanitized input to file_get_contents(), which resolves the path and reads the requested file from the server filesystem. The retrieved sensitive data (database credentials, system configuration, or other confidential files) is stored as post metadata and subsequently retrieved via the fetch-data REST API endpoint, providing the attacker with critical infrastructure secrets that could enable further compromise or lateral movement within the environment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
The EmailKit - Email Customizer for WooCommerce & WP WordPress plugin contains a path traversal vulnerability in the TemplateData class that allows authenticated administrators to read arbitrary files from the server via the 'emailkit-editor-template' REST API parameter. An attacker with Administrator privileges can exploit this flaw to access sensitive files such as wp-config.php or /etc/passwd by supplying directory traversal sequences, with the retrieved file contents stored as post metadata and retrievable through the fetch-data REST API endpoint. The vulnerability affects all versions up to and including 1.6.3, and while it requires high-level administrative access and has a moderate CVSS score of 4.9, it represents a critical information disclosure risk in multi-user WordPress environments.
Earlier versions of this analysis (1)
The EmailKit – Email Customizer for WooCommerce & WP WordPress plugin contains a path traversal vulnerability in the TemplateData class that allows authenticated administrators to read arbitrary files from the server via the 'emailkit-editor-template' REST API parameter. An attacker with Administrator privileges can exploit this flaw to access sensitive files such as wp-config.php or /etc/passwd by supplying directory traversal sequences, with the retrieved file contents stored as post metadata and retrievable through the fetch-data REST API endpoint. The vulnerability affects all versions up to and including 1.6.3, and while it requires high-level administrative access and has a moderate CVSS score of 4.9, it represents a critical information disclosure risk in multi-user WordPress environments.
RemediationAI
Immediately upgrade the EmailKit plugin to version 1.6.4 or later, which implements proper path validation and directory restriction controls. For WordPress administrators unable to patch immediately, restrict REST API access to the vulnerable endpoints through a Web Application Firewall (WAF) by blocking requests to the 'emailkit-editor-template' action parameter, or disable REST API access entirely if not required for plugin functionality. Additionally, audit current post meta entries for suspicious file paths that may have been read via this vulnerability, review administrator account activity logs for unauthorized REST API calls, and if using a multi-administrator setup, implement role-based access controls to limit who can access email customization features. Monitor WordPress security advisories at https://plugins.trac.wordpress.org/ for confirmation of the patch release and apply updates immediately upon availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the TemplateData class's action() function within the EmailKit plugin (CPE: cpe:2.3:a:roxnor:emailkit_–_email_customizer_for_woocommerce_&_wp:*:*:*:*:*:*:*:*), a WordPress plugin for email template customization. The root cause is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory – Path Traversal), where user-supplied input from a REST API parameter is passed directly to the PHP file_get_contents() function without validation, sanitization, or directory restriction. The vulnerability is compounded by the fact that the same codebase includes proper mitigation in the CheckForm class using realpath() and directory restriction, demonstrating developer awareness of the attack vector but inconsistent application of security controls across the codebase.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The EmailKit - Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 1.6.3. This is due to the action() function in the TemplateData class passing user-supplied input from the 'emailkit-editor-template' REST API parameter directly to file_get_contents() without any path validation, sanitization, or restriction to an allowed directory. This makes it possible for authenticated attackers, with Administrator-level access, to read arbitrary files on the server (such as /etc/passwd or wp-config.php) by supplying a traversal path. The file contents are stored as post meta and can subsequently be retrieved via the fetch-data REST API endpoint. Notably, the CheckForm class in the same plugin implements proper path validation using realpath() and directory restriction, demonstrating that the developer was aware of the risk but failed to apply the same protections to the TemplateData endpoint.
Executive ViewAI
Organizations using for WordPress is vulnerable to arbitrary file read via path traversal in all should be aware of moderate risk from CVE-2026-3474, a path traversal vulnerability rated CVSS 4.9. This could allow unauthorized file access. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict file access via WAF, implement allowlists.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
GitHub PoC
Exploit-DB