The EmailKit WordPress plugin up to version 1.6.5 contains an arbitrary file read vulnerability due to improper path traversal validation in the create_template() method. This flaw allows authenticated users with Author-level access or higher to read arbitrary files on the server by exploiting a logic error in PHP 8.x's handling of realpath() and strpos().