The EmailKit – Email Customizer for WooCommerce & WP plugin suffers from a CWE-22 path traversal vulnerability due to improper validation of file paths in the create_template() method of the CheckForm class. The validation uses realpath() on a base directory that may not exist, causing it to return false. In PHP 8.x, strpos() behavior with false leads to the path validation check being bypassed. Authenticated users with Author-level privileges can exploit this to read arbitrary files on the server by providing absolute file paths to the emailkit-editor-template REST API parameter. This vulnerability affects all versions up to and including 1.6.5.

An attacker with Author-level access or higher can read arbitrary files on the server, including sensitive configuration files like wp-config.php. This can lead to disclosure of sensitive information such as database credentials, potentially facilitating further attacks. The vulnerability does not allow code execution or denial of service but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict Author-level access to trusted users only and monitor for suspicious activity related to the emailkit-editor-template REST API. Avoid running the plugin on PHP 8.x environments if possible, as the vulnerability specifically exploits PHP 8.x behavior.