CVE-2026-3474: 
WordPress vulnerability analysis and mitigation

CVE-2026-3474 is an arbitrary file read vulnerability via path traversal in the EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress. It affects all versions up to and including 1.6.3. The vulnerability was published on March 21, 2026, and has a CVSS v3.1 base score of 4.9 (Medium) (Feedly, CVEFeed).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory – Path Traversal). The action() function in the TemplateData class passes user-supplied input from the emailkit-editor-template REST API parameter directly to file_get_contents() without any path validation, sanitization, or restriction to an allowed directory. An authenticated attacker with Administrator-level access can supply a traversal path (e.g., ../../etc/passwd) to read arbitrary files; the file contents are then stored as post meta and retrievable via the fetch-data REST API endpoint. Notably, the CheckForm class in the same plugin correctly implements path validation using realpath() and directory restriction, indicating the developer was aware of the risk but failed to apply equivalent protections to the TemplateData endpoint (Feedly).

Successful exploitation allows an authenticated administrator-level attacker to read arbitrary files on the server, including sensitive files such as /etc/passwd and wp-config.php (which may contain database credentials). This poses a high confidentiality risk, potentially exposing credentials that could enable lateral movement or full site compromise. Integrity and availability are not directly impacted by this vulnerability (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-3474 as of the latest available data. The vulnerability requires Administrator-level authentication, which significantly limits the attack surface. The EPSS score is approximately 0.052% (0.000520), indicating a low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, CVEFeed).

1. Authentication: Log in to the WordPress site with an account that has Administrator-level privileges.
2. Identify the vulnerable endpoint: Locate the emailkit-editor-template REST API endpoint exposed by the EmailKit plugin (versions ≤ 1.6.3).
3. Craft a path traversal request: Send a REST API request to the TemplateData action endpoint, supplying a traversal path in the emailkit-editor-template parameter (e.g., ../../../../etc/passwd or ../../../../wp-config.php).
4. Trigger file read: The action() function passes the unsanitized parameter directly to file_get_contents(), reading the targeted file from the server filesystem.
5. Retrieve file contents: The file contents are stored as WordPress post meta; the attacker then queries the fetch-data REST API endpoint to retrieve the exfiltrated file contents (Feedly).

• Network: Unusual REST API requests to the EmailKit TemplateData endpoint containing path traversal sequences (e.g., ../, ..%2F, ..%5C) in the emailkit-editor-template parameter.
• Logs: WordPress access logs showing REST API calls to /wp-json/ endpoints associated with EmailKit with anomalous parameter values containing traversal patterns; repeated requests to the fetch-data REST API endpoint shortly after.
• Database: Unexpected post meta entries in the WordPress database (wp_postmeta table) containing contents of system files such as /etc/passwd or wp-config.php credentials.

Users should update the EmailKit – Email Customizer for WooCommerce & WP plugin to a version beyond 1.6.3 that includes a patched TemplateData class with proper path validation (using realpath() and directory restriction, consistent with the existing CheckForm class). As a temporary workaround, restrict Administrator access to trusted users only and consider disabling the plugin until a patched version is available. Monitor the official WordPress plugin repository for an updated release (Feedly, Sucuri Blog).

Sucuri included CVE-2026-3474 in their March 2026 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues requiring attention (Sucuri Blog). Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published alerts for this vulnerability (INCIBE-CERT, CCN-CERT). No significant social media discussion or notable researcher commentary beyond standard aggregator coverage has been observed.