The EmailKit – Email Customizer for WooCommerce & WP plugin suffers from an arbitrary file read vulnerability due to missing path validation in the create_template REST API endpoint. Specifically, user input from the emailkit-editor-template parameter is directly used in a file_get_contents() call without sanitization, allowing authenticated users with Author-level privileges or higher to perform path traversal attacks. This enables reading of arbitrary files on the server, including sensitive configuration files. The file contents are stored in post meta and can be exfiltrated via MetForm's email confirmation feature. The vulnerability affects all versions up to and including 1.6.1. The CVSS v3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges.

An attacker with Author-level or higher permissions on a WordPress site using the vulnerable EmailKit plugin can read arbitrary files on the server. This can lead to exposure of sensitive information such as system user data (/etc/passwd) and WordPress configuration (wp-config.php), potentially aiding further attacks or privilege escalation. The vulnerability does not allow modification or denial of service but compromises confidentiality of server files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level permissions to trusted users only and consider disabling or removing the EmailKit plugin if possible. Monitor for updates from the vendor (roxnor) and apply official patches once released.