Path Traversal Vulnerability in EmailKit Plugin for WordPress

CVE-2025-14059

What is CVE-2025-14059?

The EmailKit plugin for WordPress is exposed to a significant security flaw that allows authenticated attackers with Author-level permissions or higher to perform Arbitrary File Read operations. This vulnerability arises from inadequate path validation in the create_template REST API endpoint. User-controlled input from the emailkit-editor-template parameter is passed directly to the file_get_contents() function without proper sanitization, enabling attackers to access sensitive files on the server, like /etc/passwd and wp-config.php. The exfiltrated data can be stored in post meta and accessed through MetForm's email confirmation feature, posing a serious risk to the confidentiality and integrity of the WordPress environment.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References