CVE-2025-14059: 
WordPress vulnerability analysis and mitigation

CVE-2025-14059 is an Arbitrary File Read vulnerability via Path Traversal in the EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress. It affects all versions up to and including 1.6.1, and was disclosed on January 7, 2026, with Wordfence as the assigning CNA. The flaw allows authenticated attackers with Author-level permissions or higher to read arbitrary files on the server via the REST API. It carries a CVSS v3.1 base score of 6.5 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-73 (External Control of File Name or Path): the create_template REST API endpoint accepts user-controlled input via the emailkit-editor-template parameter and passes it directly to PHP's file_get_contents() without any path validation or sanitization. An attacker can supply path traversal sequences (e.g., ../../) to escape the intended directory and read arbitrary files on the server. The vulnerable code is located in includes/Admin/Api/CheckForm.php at line 163. File contents are stored in WordPress post meta and can subsequently be exfiltrated via MetForm's email confirmation feature, providing a complete read-and-exfiltrate attack chain (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated attacker to read any file accessible to the web server process, including highly sensitive files such as /etc/passwd and wp-config.php (which contains database credentials and WordPress secret keys). Exposure of wp-config.php can lead to full database compromise, privilege escalation, and potential site takeover. The vulnerability has no integrity or availability impact, but the confidentiality impact is rated High (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum Author-level WordPress authentication, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Reconnaissance: Identify WordPress sites running the EmailKit plugin (versions ≤ 1.6.1) using tools like WPScan or by checking /wp-content/plugins/emailkit/ for plugin presence.
2. Obtain Author-level credentials: Acquire or compromise a WordPress account with at minimum Author-level permissions (e.g., via credential stuffing, phishing, or brute force).
3. Authenticate to the REST API: Obtain a valid authentication nonce or use application passwords to authenticate REST API requests.
4. Craft malicious REST API request: Send a POST request to the create_template REST API endpoint, supplying a path traversal payload in the emailkit-editor-template parameter, e.g., ../../../../etc/passwd or ../../../../wp-config.php.
5. Retrieve file contents from post meta: The file contents are stored in WordPress post meta associated with the created template. Query the post meta via the WordPress REST API or admin interface to retrieve the exfiltrated data.
6. Exfiltrate via MetForm: If MetForm is installed, trigger an email confirmation to receive the stored file contents via email, completing the exfiltration chain (Wordfence, WordPress Trac).

• Network: Unusual REST API POST requests to the create_template endpoint containing path traversal sequences (e.g., ../, %2e%2e%2f) in the emailkit-editor-template parameter.
• Logs: WordPress access logs showing REST API calls to /wp-json/emailkit/v1/create_template (or similar) with suspicious parameter values referencing system files like passwd or wp-config.php.
• Database: WordPress post meta entries containing the contents of system files (e.g., /etc/passwd entries or PHP configuration strings from wp-config.php) stored unexpectedly.
• Email: Outbound emails triggered by MetForm containing file system content (e.g., Unix password file format or PHP database credentials) in confirmation messages.

Users should update the EmailKit plugin to a version beyond 1.6.1 that includes the patch introduced in changeset 3419280. The fix adds proper path validation to the create_template REST API endpoint to prevent traversal outside the intended directory. As an interim workaround, site administrators can restrict Author-level user accounts or disable the EmailKit plugin until a patched version is applied. Monitoring REST API access logs for path traversal patterns is also recommended (WordPress Trac Changeset, Wordfence).

Wordfence included CVE-2025-14059 in its weekly WordPress vulnerability report for January 5–11, 2026, highlighting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence Blog). Sucuri also referenced the vulnerability in its January 2026 vulnerability patch roundup (Sucuri Blog). No significant social media controversy or notable researcher commentary beyond standard disclosure coverage has been observed.