CVE-2025-14059 Details

A path traversal vulnerability allowing arbitrary file read has been identified in the EmailKit plugin for WordPress, affecting all versions through 1.6.1. The issue arises in the create_template REST API endpoint, where the emailkit-editor-template parameter is accepted without proper path validation. This flaw enables authenticated attackers with Author-level permissions or higher to access arbitrary files on the server, including sensitive configuration files such as /etc/passwd and wp-config.php. The accessed file contents are then stored in post meta and can be sent via email using MetForm's email confirmation feature.

Users are advised to update the EmailKit WordPress plugin to version 1.6.2 or later, where this vulnerability has been patched.