Path Traversal Vulnerability in EmailKit Plugin for WordPress

CVE-2026-5957

What is CVE-2026-5957?

The EmailKit plugin for WordPress has a vulnerability that allows authenticated users with Author-level access and above to exploit flaws in the path traversal validation within the create_template() method. This can lead to Arbitrary File Read, enabling attackers to access sensitive files, such as wp-config.php, by manipulating the emailkit-editor-template REST API parameter with an absolute path. In PHP 8.x, a flaw in the validation logic involving the realpath() function can cause the validation checks to fail, thereby bypassing security measures designed to protect server files.

References