EUVD-2026-54382
GHSA-4vxc-ggfm-6c86
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
No authentication or interaction needed to reach the unprotected handler; impact is limited to credential overwrite (I:L) and admin service disruption (A:L), with no data disclosure.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site's cloud template library to attacker-controlled content.
AnalysisAI
Unauthenticated cloud credential hijacking in the Templately WordPress plugin (all versions before 3.7.1) allows any remote attacker to overwrite the site administrator's stored cloud service connection with an account under their control. This severs the legitimate administrator's access to the cloud template library and redirects the site's template source to attacker-controlled infrastructure, enabling supply-chain-style content injection against the WordPress admin. A publicly available proof-of-concept exists per WPScan, though EPSS remains very low (0.14%, 3rd percentile), and no CISA KEV listing confirms active widespread exploitation at time of analysis.
Technical ContextAI
Templately is a WordPress template library plugin that authenticates against a cloud service to fetch and deliver pre-built page templates for use in page builders. The cloud connection is stored as a privileged site setting - effectively an OAuth token or API credential - that determines which template library the WordPress installation consumes. The root cause is CWE-862 (Missing Authorization): the request handler responsible for writing this credential to the database does not perform any WordPress capability check (such as current_user_can('manage_options')), meaning it accepts and processes requests from completely unauthenticated callers. The affected product scope is defined by CPE cpe:2.3:a:unknown:templately:*:*:*:*:*:*:*:* covering all versions in the range 0 through below 3.7.1. The vendor field being listed as 'unknown' in the CPE indicates NVD attribution is not yet fully resolved, though the WPScan advisory and description unambiguously identify Templately.
RemediationAI
Update the Templately WordPress plugin to version 3.7.1 or later, which is confirmed as the vendor-released patch per the WPScan advisory (https://wpscan.com/vulnerability/d4749a25-f3fa-4908-9532-3ae7c1c38a58/). If immediate patching is not feasible, a compensating control is to disable the Templately plugin entirely until the update can be applied - this eliminates the attack surface at the cost of losing template library access. Alternatively, a WAF rule blocking unauthenticated POST requests to Templately's AJAX or REST API handlers (typically targeting wp-admin/admin-ajax.php with Templately-specific action parameters) can mitigate exploitation without disabling the plugin, though the exact action parameter should be confirmed from the WPScan advisory detail. After patching or remediating, administrators should audit Templately's stored cloud connection settings in the WordPress admin panel to verify the credentials have not already been overwritten by an attacker prior to remediation.
More in Templately
View allMissing Authorization vulnerability in WPDeveloper Templately templately.1.2. Rated medium severity (CVSS 6.5), this vul
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, all
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to i
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today