Templazee CVE-2025-49949
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable WordPress endpoint requires low-privilege account (PR:L); limited read/write impact within plugin scope only; no availability or scope-change impact described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in templazee Templazee templazee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templazee: from n/a through <= 1.0.2.
AnalysisAI
Missing authorization in the Templazee WordPress plugin (versions through 1.0.2) permits authenticated low-privileged users to invoke restricted plugin functionality by exploiting improperly enforced access control boundaries. The CVSS PR:L metric confirms that a valid WordPress account with minimal privileges - such as a subscriber - is sufficient to trigger the flaw over the network with no additional interaction required. No public exploit code is identified at time of analysis, and an EPSS score of 0.01% (1st percentile) signals extremely low observed exploitation probability.
Technical ContextAI
Templazee is a WordPress plugin for template management developed by the vendor 'templazee', affected through version 1.0.2. The vulnerability is rooted in CWE-862 (Missing Authorization), a class of flaw where PHP functions registered as WordPress AJAX handlers or REST API endpoints fail to perform adequate capability checks - such as calling current_user_can() - before executing sensitive operations. Without these guards, any authenticated WordPress user can directly invoke privileged actions the plugin exposes over HTTP. The CVSS vector AV:N/AC:L confirms no special network position or configuration is required to reach the vulnerable endpoint; the flaw is inherent to the plugin's access control logic rather than its deployment environment.
Affected ProductsAI
The Templazee WordPress plugin by templazee is affected in all versions from initial availability through and including version 1.0.2. No NVD CPE string was included in the source data. The vulnerability is documented in the Patchstack advisory database at https://patchstack.com/database/Wordpress/Plugin/templazee/vulnerability/wordpress-templazee-plugin-1-0-2-broken-access-control-vulnerability. No other products or platforms are identified as affected.
RemediationAI
Administrators should consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/templazee/vulnerability/wordpress-templazee-plugin-1-0-2-broken-access-control-vulnerability and update the Templazee plugin to the first version released after 1.0.2 that addresses this flaw - no specific patched version number is confirmed in the available data. If no patched release is yet available in the WordPress.org plugin repository, the most effective compensating control is to deactivate and remove the plugin entirely, which eliminates the attack surface without side effects for sites not dependent on its functionality. For sites that must retain the plugin, restrict WordPress user registration to trusted accounts only (Settings > General > uncheck 'Anyone can register') to limit the attacker pool; note this does not remediate the flaw but raises the barrier to exploitation by requiring an invitation or manual account creation before abuse is possible.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today