CVE-2026-3474 is a path traversal vulnerability (CWE-22) in the EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress, affecting all versions up to 1.6.3. The issue exists in the TemplateData class's action() function, which takes user input from the 'emailkit-editor-template' REST API parameter and passes it directly to file_get_contents() without validating or restricting the file path. This allows authenticated users with Administrator privileges to read arbitrary files on the server by supplying traversal sequences. The file contents are stored as post meta and can be retrieved via another REST API endpoint. The presence of proper path validation in another class (CheckForm) indicates developer awareness but inconsistent application of security controls. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity). No patch or official fix is currently documented.

An authenticated attacker with Administrator-level access can exploit this vulnerability to read arbitrary files on the server hosting the WordPress site. This may include sensitive files such as /etc/passwd or wp-config.php, potentially exposing credentials or configuration details. The vulnerability does not allow code execution or denial of service but compromises confidentiality of server files. The impact is limited by the requirement for Administrator privileges and the absence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator access to trusted users only and monitor for unusual activity involving the 'emailkit-editor-template' REST API endpoint. Consider disabling or restricting the plugin if possible. Since the vulnerability requires Administrator privileges, limiting administrative accounts reduces risk.