Analysis Report Folder Analysis cache/emailkit_1.6.1 → cache/emailkit_1.6.2 - CVE-2025-14059

I'll analyze the provided code diff for security vulnerabilities.

Vulnerability Existed: no

No vulnerabilities identified - [File] EmailKit.php [Lines 9, 71]

Old Code:
```
* Version: 1.6.1
...
define('EMAILKIT_VERSION', '1.6.1');
```

Fixed Code:
```
* Version: 1.6.2
...
define('EMAILKIT_VERSION', '1.6.2');
```

Explanation:
This diff only contains version number updates from 1.6.1 to 1.6.2 in two locations (the file header comment and a PHP constant definition). These are purely cosmetic/metadata changes with no functional code modifications. Version bumps do not introduce or fix security vulnerabilities unless they reference actual code changes that address security issues. Since no functional code changes are present in this diff, there are no security fixes to analyze and no vulnerabilities are present in these changes.

# Security Analysis: Code Diff for CheckForm.php

## Vulnerability 1: Path Traversal / Directory Traversal

**Vulnerability Existed:** yes

**CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - includes/Admin/Api/CheckForm.php Lines 163-165**

**Old Code:**
```php
$template_path = $request->get_param('emailkit-editor-template');
$template = file_exists($template_path) ? file_get_contents($template_path) : '';
$html_path = str_replace("content.json", "content.html", $template_path);
$html = file_exists($html_path) ? file_get_contents($html_path) : '';
```

**Fixed Code:**
```php
$template_path = $request->get_param('emailkit-editor-template');
$allowed_base_path = wp_upload_dir()['basedir'] . '/emailkit/templates/';
$real_path = realpath($template_path);
if ($real_path === false || strpos($real_path, realpath($allowed_base_path)) !== 0) {
    return new WP_REST_Response(['success' => false, 'message' => __('Invalid template path', 'emailkit')], 400);
}

$template = file_exists($real_path) ? file_get_contents($real_path) : '';
$html_path = str_replace("content.json", "content.html", $real_path);

// Validate HTML path as well
$real_html_path = realpath($html_path);
if ($real_html_path !== false && strpos($real_html_path, realpath($allowed_base_path)) === 0) {
    $html = file_exists($real_html_path) ? file_get_contents($real_html_path) : '';
}
```

**Explanation:**
The original code directly used user-supplied input (`$template_path` from `$request->get_param()`) to read files without validating that the path was within an allowed directory. An attacker could use path traversal sequences (e.g., `../../etc/passwd`) to read arbitrary files from the server. The fix implements proper path validation by:
1. Using `realpath()` to resolve the absolute path and detect traversal attempts
2. Comparing the resolved path against an allowed base directory (`wp_upload_dir()['basedir'] . '/emailkit/templates/'`)
3. Rejecting any paths outside the allowed directory
4. Applying the same validation to both the template and HTML file paths

---

## Vulnerability 2: Stored Cross-Site Scripting (XSS)

**Vulnerability Existed:** yes

**CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - includes/Admin/Api/CheckForm.php Lines 172-180**

**Old Code:**
```php
'meta_input' => [
    'emailkit_template_type' => $template_type,
    'emailkit_form_id' => $form_id,
    'emailkit_template_status' => 'active',
    'emailkit_template_content_html' => $html,
    'emailkit_template_content_object' => $template,
    'emailkit_email_type' => $request->get_param('emailkit_email_type'),
]
```

**Fixed Code:**
```php
'meta_input' => [
    'emailkit_template_type' => sanitize_text_field($template_type),
    'emailkit_form_id' => absint($form_id),
    'emailkit_template_status' => 'active',
    'emailkit_template_content_html' => wp_kses_post($html),
    'emailkit_template_content_object' => $template,
    'emailkit_email_type' => sanitize_text_field($request->get_param('emailkit_email_type')),
]
```

**Explanation:**
The original code stored unsanitized user input directly into post metadata without any sanitization. This allowed attackers to inject malicious scripts that would be stored in the database and executed when the data was later retrieved and displayed. Additionally, `$post_title` was not sanitized. The fix applies appropriate sanitization functions:
- `sanitize_text_field()` for text inputs (`template_type`, `template_title`, `emailkit_email_type`) - removes HTML/script tags
- `absint()` for numeric input (`form_id`) - ensures only integers
- `wp_kses_post()` for HTML content (`$html`) - allows safe HTML while removing dangerous elements

---

## Vulnerability 3: Improper Input Validation

**Vulnerability Existed:** yes

**CWE-20 - Improper Input Validation - includes/Admin/Api/CheckForm.php Lines 164, 184**

**Old Code:**
```php
$post_title = $template_title,  // No type checking or validation
'post_title' => $template_title,
'emailkit_form_id' => $form_id,  // No integer validation
```

**Fixed Code:**
```php
'post_title' => sanitize_text_field($template_title),
'emailkit_form_id' => absint($form_id),
```

**Explanation:**
The original code accepted and stored user input without validating expected data types or formats. The `$form_id` parameter should be numeric but was stored as-is, potentially allowing non-integer values. The `$template_title` should be text but had no validation. The fix validates input types: `absint()` coerces to integer (preventing SQL injection or type confusion), and `sanitize_text_field()` ensures text input is properly formatted and stripped of HTML.

I'll analyze this code diff for security vulnerabilities.

Vulnerability Existed: yes
FALSE POSITIVE

**Insecure Comparison / Type Juggling Vulnerability - CWE-1025** - includes/Admin/EmailKitEditor/EmailKitEditorInit.php - Line 46

**Old Code:**
```php
if(is_plugin_active('uafrica-shipping/uafrica-shipping.php')){
```

**Fixed Code:**
```php
if(is_plugin_active('uafrica-shipping/uafrica-shipping.php') || ( get_template() == 'entry' )){
```

**Explanation:**
The added condition `get_template() == 'entry'` uses a loose comparison operator (`==`) instead of a strict comparison operator (`===`). This creates a type juggling vulnerability where `get_template()` could return a value that is loosely equal to the string `'entry'` without being exactly that string. For example, if `get_template()` returns an integer `0` or an empty string, the loose comparison would still evaluate to true in certain PHP versions or contexts, potentially allowing unintended code execution. The fix should use `get_template() === 'entry'` for strict type comparison to prevent type juggling attacks.

I'll analyze this code diff for security vulnerabilities.

Vulnerability Existed: no
No CWE - N/A - includes/Admin/EmailSettings/MetformEmailSettings.php (Line 97)

Old Code:
```
<a class="upgrade-button" target="_blank" href="https://wpmet.com/plugin/metform/pricing/">
```

Fixed Code:
```
<a class="upgrade-button" target="_blank" href="https://wpmet.com/plugin/emailkit/pricing/">
```

Explanation:
This change updates a hyperlink URL from `https://wpmet.com/plugin/metform/pricing/` to `https://wpmet.com/plugin/emailkit/pricing/`. This is a simple URL correction that fixes an incorrect product reference in a marketing link. No security vulnerability exists in either version. The link is hardcoded, uses HTTPS protocol, and does not involve any user input, data processing, or sensitive operations that could introduce security risks. This is a legitimate bug fix to ensure the link directs users to the correct product page.

I'll analyze this code diff for security vulnerabilities.

```
Vulnerability Existed: yes
FALSE POSITIVE
Improper Input Validation - CWE-20 - includes/Admin/MetaField/StyleLoad.php - Lines 105-106

Old Code:
[No previous code - this is a new addition]

Fixed Code:
if ( isset($_GET['action']) && $_GET['action'] == 'emailkit-builder' && get_template() == 'entry' ) {

Explanation:
This code contains a security vulnerability. The condition checks `$_GET['action']` directly without proper sanitization or validation. While the code uses a simple string comparison (`== 'emailkit-builder'`), which provides some protection against exploitation, directly accessing unsanitized `$_GET` superglobals is poor practice and violates WordPress security standards.

The vulnerability is:
- **CWE-20 (Improper Input Validation)**: The `$_GET['action']` value is not sanitized, escaped, or validated before use
- **WordPress Best Practice Violation**: WordPress recommends using sanitization functions like `sanitize_text_field()` or `wp_verify_nonce()` for GET parameters
- **Potential Issue**: While the string comparison reduces immediate risk, best practice requires: `isset($_GET['action']) && sanitize_text_field($_GET['action']) == 'emailkit-builder'`

The fix would be to sanitize the GET parameter:
```php
if ( isset($_GET['action']) && sanitize_text_field($_GET['action']) == 'emailkit-builder' && get_template() == 'entry' ) {
```

Additionally, using a nonce to verify the request origin would provide defense-in-depth protection.
```