CVE-2026-3474: EmailKit WordPress Path Traversal Flaw

CVE-2026-3474 Overview

The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress contains a path traversal vulnerability that allows authenticated attackers with Administrator-level access to read arbitrary files on the server. The vulnerability exists in the action() function within the TemplateData class, where user-supplied input from the emailkit-editor-template REST API parameter is passed directly to file_get_contents() without proper path validation, sanitization, or directory restriction.

Critical Impact

Authenticated administrators can read sensitive server files including /etc/passwd and wp-config.php, potentially exposing database credentials, authentication keys, and other critical configuration data.

Affected Products

• EmailKit – Email Customizer for WooCommerce & WP plugin version 1.6.3 and earlier
• WordPress installations running vulnerable EmailKit versions

Discovery Timeline

• 2026-03-21 - CVE CVE-2026-3474 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-3474

Vulnerability Analysis

This path traversal vulnerability (CWE-22) represents a failure to implement consistent input validation across the plugin's codebase. The vulnerability is particularly notable because the same plugin implements proper path validation in a different class (CheckForm), which uses realpath() and directory restriction—demonstrating that the developer understood the risk but failed to apply the same protections uniformly.

The attack requires administrator-level authentication, which limits the attack surface but does not eliminate the risk. In shared hosting environments or scenarios involving compromised admin accounts, this vulnerability enables complete file system reconnaissance and exposure of sensitive configuration files.

Root Cause

The root cause is the direct passage of unsanitized user input to PHP's file_get_contents() function within the TemplateData class. The action() function accepts the emailkit-editor-template REST API parameter and processes it without implementing:

• Path canonicalization via realpath()
• Directory restriction to allowed paths
• Input sanitization to strip traversal sequences like ../
• Whitelist validation against allowed template files

This inconsistent security implementation between the TemplateData and CheckForm classes suggests a gap in security code review practices during development.

Attack Vector

The attack is network-accessible and requires administrator authentication. An attacker with compromised or legitimate admin credentials can craft a malicious REST API request to the emailkit-editor-template endpoint, supplying a traversal path such as ../../../etc/passwd or ../../../wp-config.php. The file contents are then stored as post meta and can be retrieved via the fetch-data REST API endpoint.

The exploitation flow involves:

1. Authenticating as a WordPress administrator
2. Sending a crafted request to the vulnerable REST API endpoint with a traversal payload
3. Retrieving the exfiltrated file contents via the fetch-data endpoint

For technical details on the vulnerable code, refer to the WordPress Plugin TemplateData source code.

Detection Methods for CVE-2026-3474

Indicators of Compromise

• Unusual REST API requests to emailkit-editor-template endpoints containing path traversal sequences (../, ..%2f, ..%252f)
• Post meta entries containing system file contents (e.g., /etc/passwd format, wp-config.php content)
• Access logs showing repeated requests to EmailKit REST API endpoints from admin accounts
• Unexpected fetch-data endpoint requests following template endpoint access

Detection Strategies

• Monitor WordPress REST API logs for requests containing directory traversal patterns in the emailkit-editor-template parameter
• Implement Web Application Firewall (WAF) rules to detect and block path traversal sequences in REST API requests
• Review post meta tables for suspicious content that resembles system configuration files
• Enable and monitor WordPress debug logging for file access errors outside the plugin directory

Monitoring Recommendations

• Configure SIEM alerts for path traversal patterns (../, encoded variants) in WordPress REST API traffic
• Establish baseline behavior for administrator REST API usage and alert on anomalies
• Monitor file access patterns on the server for reads outside the WordPress installation directory
• Implement audit logging for all administrator-level REST API interactions

How to Mitigate CVE-2026-3474

Immediate Actions Required

• Update EmailKit plugin to the latest patched version immediately
• Audit administrator accounts for unauthorized access or compromised credentials
• Review server access logs for evidence of exploitation attempts
• Rotate sensitive credentials (database passwords, WordPress salts) if exploitation is suspected
• Temporarily disable the EmailKit plugin if an immediate update is not possible

Patch Information

The vulnerability affects EmailKit versions up to and including 1.6.3. Users should update to the latest available version that includes the security fix. The patch should implement proper path validation using realpath() and directory restriction, consistent with the existing CheckForm class implementation. Review the WordPress Plugin Changeset for specific code changes and the Wordfence Vulnerability Analysis for additional remediation guidance.

Workarounds

• Restrict administrator access to only trusted users and enforce strong authentication (MFA)
• Implement a Web Application Firewall with rules blocking path traversal patterns
• Use file system permissions to restrict PHP process access to sensitive directories
• Disable the EmailKit plugin entirely until a patch can be applied

# Temporarily disable EmailKit plugin via WP-CLI
wp plugin deactivate emailkit

# Verify plugin is deactivated
wp plugin list --status=inactive | grep emailkit