CVE-2025-14059

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14059", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-04T19:21:34.885Z", "datePublished": "2026-01-07T03:21:03.835Z", "dateUpdated": "2026-04-08T17:09:19.168Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:09:19.168Z"}, "affected": [{"vendor": "roxnor", "product": "EmailKit \u2013 Email Customizer for WooCommerce & WP", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from the emailkit-editor-template parameter is passed directly to file_get_contents() without sanitization. This makes it possible for authenticated attackers with Author-level permissions or higher to read arbitrary files on the server, including sensitive configuration files like /etc/passwd and wp-config.php, via the REST API. The file contents are stored in post meta and can be exfiltrated through MetForm's email confirmation feature."}], "title": "EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/91ebe8cb-99ec-4380-a77e-17e17144a17e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/emailkit/trunk/includes/Admin/Api/CheckForm.php#L163"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3419280%40emailkit%2Ftrunk&old=3373383%40emailkit%2Ftrunk&sfp_email=&sfph_mail=#file1"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-73 External Control of File Name or Path", "cweId": "CWE-73", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-12-04T19:36:58.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-06T14:21:45.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-07T14:53:14.950883Z", "id": "CVE-2025-14059", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T16:14:50.860Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14059", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-07T14:53:14.950883Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-07T14:53:17.315Z"}}], "cna": {"title": "EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "roxnor", "product": "EmailKit \u2013 Email Customizer for WooCommerce & WP", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.6.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-04T19:36:58.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-06T14:21:45.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/91ebe8cb-99ec-4380-a77e-17e17144a17e?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/emailkit/trunk/includes/Admin/Api/CheckForm.php#L163"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3419280%40emailkit%2Ftrunk&old=3373383%40emailkit%2Ftrunk&sfp_email=&sfph_mail=#file1"}], "descriptions": [{"lang": "en", "value": "The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from the emailkit-editor-template parameter is passed directly to file_get_contents() without sanitization. This makes it possible for authenticated attackers with Author-level permissions or higher to read arbitrary files on the server, including sensitive configuration files like /etc/passwd and wp-config.php, via the REST API. The file contents are stored in post meta and can be exfiltrated through MetForm's email confirmation feature."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "CWE-73 External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-07T03:21:03.835Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14059", "state": "PUBLISHED", "dateUpdated": "2026-01-07T16:14:50.860Z", "dateReserved": "2025-12-04T19:21:34.885Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-07T03:21:03.835Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EmailKit \u2013 Email Customizer for WooCommerce & WP", "vendor": "roxnor", "versions": [{"lessThanOrEqual": "1.6.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing path validation in the create_template REST API endpoint where user-controlled input from the emailkit-editor-template parameter is passed directly to file_get_contents() without sanitization. This makes it possible for authenticated attackers with Author-level permissions or higher to read arbitrary files on the server, including sensitive configuration files like /etc/passwd and wp-config.php, via the REST API. The file contents are stored in post meta and can be exfiltrated through MetForm's email confirmation feature."}, {"lang": "es", "value": "El plugin EmailKit para WordPress es vulnerable a la lectura arbitraria de archivos a trav\u00e9s de salto de ruta en todas las versiones hasta la 1.6.1, inclusive. Esto se debe a la falta de validaci\u00f3n de ruta en el endpoint de la API REST create_template, donde la entrada controlada por el usuario del par\u00e1metro emailkit-editor-template se pasa directamente a file_get_contents() sin sanitizaci\u00f3n. Esto hace posible que atacantes autenticados con permisos de nivel de Autor o superiores lean archivos arbitrarios en el servidor, incluyendo archivos de configuraci\u00f3n sensibles como /etc /passwd y wp-config.php, a trav\u00e9s de la API REST. El contenido del archivo se almacena en post meta y puede ser exfiltrado a trav\u00e9s de la funci\u00f3n de confirmaci\u00f3n de correo electr\u00f3nico de MetForm."}], "id": "CVE-2025-14059", "lastModified": "2026-06-17T08:35:15.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14059", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-07T14:53:14.950883Z", "version": "2.0.3"}}]}, "published": "2026-01-07T12:16:51.647", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/emailkit/trunk/includes/Admin/Api/CheckForm.php#L163"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3419280%40emailkit%2Ftrunk&old=3373383%40emailkit%2Ftrunk&sfp_email=&sfph_mail=#file1"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/91ebe8cb-99ec-4380-a77e-17e17144a17e?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:05:54.638122+00:00", "value": {"mitigation_remediation": ["Update the EmailKit plugin to the latest available version that removes the unauthenticated use of file_get_contents() and validates file paths.", "If an update is unavailable, temporarily disable the create_template REST API endpoint or revoke Author-level permissions that allow access to it.", "Apply input validation to the emailkit-editor-template parameter, restricting file access to a safe directory or whitelist of known files."], "summary": {"action": "Apply Patch", "impact": "File Disclosure via Path Traversal"}, "threat_synthesis": {"affected_systems": "Any WordPress site using the EmailKit \u2013 Email Customizer for WooCommerce & WP plugin, versions up to and including 1.6.1. The issue affects all installations of the plugin where the create_template endpoint is active.", "description_and_impact": "The vulnerability resides in the EmailKit plugin\u2019s REST API endpoint create_template, where the emailkit\u2011editor\u2011template parameter is passed directly to file_get_contents() without validation. This omission allows an authenticated user with Author-level or higher permissions to include a crafted path that resolves to arbitrary files on the server, such as /etc/passwd or wp-config.php. The attacker\u2019s ability to read these files amounts to a confidentiality breach, exposing sensitive configuration data and potentially credentials. The weakness is identified as Path Traversal (CWE\u201173).", "risk_and_exploitability": "With a CVSS score of 6.5 the vulnerability is considered moderate severity. The EPSS score is below 1\u202f% and the vulnerability is not listed in CISA\u2019s KEV catalog, indicating that, while the risk of exploitation is currently low, it remains realistic for victims who have authorized authorship access. An attacker would need only normal author privileges to send a crafted request to the REST API, read any file the web server can access, and exfiltrate the contents via post meta saved in the plugin\u2019s database. The potential impact is limited to confidentiality loss of server files but could enable further attacks if sensitive files are accessed."}}}}, "created": "2026-01-07T10:08:07.523773+00:00", "updated": "2026-04-22T00:15:03.768269+00:00", "vendors": ["roxnor", "roxnor$PRODUCT$emailkit", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}