EUVD-2026-59601
GHSA-wqqc-79qg-345q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain contributor-level WordPress credentials
-
DeliveryCraft GIF+PHP polyglot with embedded web shell
-
ExploitHost polyglot at attacker-controlled URL with .php path component
-
InstallPOST upload request to /templately/v1/clouds/upload with spoofed .gif Content-Disposition filename
-
C2Plugin validates Content-Disposition filename as image/gif while writing file to .php destination
-
ExecuteHTTP GET request to uploaded shell path
-
ImpactArbitrary command execution as web server user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid WordPress user account with at minimum the contributor role, which holds the delete_posts capability used as the sole authorization gate across all of Templately's state-changing REST API endpoints. No administrator interaction, no social engineering, and no non-default plugin configuration are required - any WordPress installation with the Templately plugin active and at least one contributor-level account is exploitable in its default installed state. The critical prerequisite is that the attacker must control an external server from which to serve the polyglot file at a URL with a .php path component, enabling the destination filename to resolve to a .php extension. Exploitation is bounded to WordPress installations running Templately versions 0 through 3.7.1; sites with no contributor-level accounts registered are not exposed. The unfiltered_upload capability restriction, which normally prevents contributors from uploading PHP files, is completely bypassed by the validation mismatch and provides no limiting protection. |
| Impact | CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects severity: the attack is fully network-exploitable with low complexity, requires only contributor-level WordPress credentials, and yields full server compromise. No CISA KEV listing and no confirmed public exploit code exist at time of analysis; EPSS data was not present in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified from that signal. However, the mechanical simplicity of the attack - craft a polyglot file, host it at a URL with a .php path, POST to a documented endpoint - and the granular public disclosure of affected file paths, line numbers, and endpoint names substantially lower the barrier to weaponization, meaning even a mid-sized municipal IT team in gliwice managing a public-facing WordPress installation with contributor accounts should treat this as urgent rather than deferring to the absence of a KEV entry as a proxy for low real-world risk. The overly permissive REST API authorization (delete_posts for all state-changing cloud operations) compounds the risk because contributor accounts are routinely granted on editorial and community sites, broadening the attacker pool. |
| Exploit ScenarioDerived | An attacker with a contributor account on the target WordPress site crafts a GIF+PHP polyglot file containing an embedded PHP web shell and hosts it at an attacker-controlled server at a URL with a .php extension in the path. The attacker sends a POST request to /templately/v1/clouds/upload with a Content-Disposition header presenting the file as shell.gif; the plugin validates the Content-Disposition filename as image/gif but writes the file to a .php path derived from the URL, placing an executable PHP file in the WordPress uploads directory. The attacker then directly requests the uploaded file's URL via HTTP to execute arbitrary operating system commands as the web server process user. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 15, 2026
Remote code execution in the Templately WordPress plugin (all versions through 3.7.1) is reachable by any authenticated contributor-level user due to a validation/destination mismatch in the fetch_remote_file function. A GIF+PHP polyglot file passes WordPress's wp_check_filetype_and_ext validation by presenting a .gif Content-Disposition filename, while the actual file is written to a .php extension path derived from the attacker-controlled request URL, entirely bypassing the unfiltered_upload capability gate. CVSS 8.8 reflects the low privilege bar and full C/I/A impact; no public exploit has been identified at time of analysis, but the detailed public disclosure of affected endpoints and code paths makes rapid exploit development likely.
RemediationAI
An upstream fix is available via WordPress trac changeset 3636643 targeting WPImport.php; however, a specific patched plugin release version is not independently confirmed from the available data - monitor the Templately listing on WordPress.org and apply the update immediately once a patched release is published. As an interim compensating control, administrators should audit and remove the contributor role from all non-essential accounts, since exploitation requires at minimum contributor-level access; this reduces the attacker pool without disabling the plugin. A WAF rule blocking POST requests to /templately/v1/clouds/upload and /templately/v1/insert will prevent the primary upload exploitation vector, though this disables Templately cloud import functionality as a trade-off. If cloud import features are not actively used, deactivating the Templately plugin entirely eliminates all attack surface with no operational impact. The vendor's complete remediation should additionally validate file type against the actual destination filename rather than the Content-Disposition header, avoid deriving write paths from request URLs, and restrict /templately/v1/login with global_signin=true to an administrator-level capability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the fetch_remote_file function within WPImport.php, confirmed across both the 3.6.5 and 3.7.1 plugin tags via WordPress trac references (WPImport.php:L1200, L1391, L1423). CWE-434 (Unrestricted Upload of File with Dangerous Type) describes the root cause: file type validation is decoupled from the write destination. WordPress's built-in wp_check_filetype_and_ext inspects the Content-Disposition header's filename - attacker-supplied - and classifies the upload as image/gif, while the function simultaneously derives the destination write path from the request URL and appends a .php extension. This split creates a validation/destination mismatch where the gating check and the actual file operation operate on entirely different filenames. The REST API surface - covering endpoints /templately/v1/clouds/upload, /templately/v1/insert, and /templately/v1/login - is gated only by current_user_can('delete_posts') (confirmed in API.php:L128), a capability held by contributors, rather than the more restrictive manage_options or unfiltered_upload capabilities normally required for server-side file execution paths.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Contributor credentials (PR:L) grant REST API access over the network (AV:N); polyglot construction and endpoint targeting are mechanical (AC:L); full server RCE yields C/I/A:H with no scope change.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The Templately - Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately's entire REST API - including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) - is authorized only by a current_user_can('delete_posts') check, with no administrator or manage_options capability requirement. The same permission gate also allows a contributor to overwrite the site's global Templately cloud connection via the /templately/v1/login endpoint with global_signin set to true. A complete remediation should both correct fetch_remote_file to validate the file type against the actual destination filename rather than the Content-Disposition header (and avoid deriving the write path from the request URL), and restrict state-changing Templately REST routes to an appropriate administrator-level capability.
Executive ViewAI
The Templately WordPress plugin (all versions through 3.7.1) contains a remote code execution vulnerability (CVSS 8.8) exploitable by any authenticated contributor-level user through a file validation bypass that allows arbitrary PHP execution. This affects WordPress sites across your organization running this plugin, enabling attackers to fully compromise site integrity, steal sensitive data, and pivot to backend systems. With no vendor patch currently available and public disclosure of affected endpoints, rapid exploit development is highly likely, making this an immediate organizational threat.
No vendor-released patch identified at time of analysis. Interim mitigations: immediately disable the Templately plugin on non-critical sites; restrict the WordPress contributor role to trusted users with mandatory review for new contributors; deploy Web Application Firewall rules blocking requests to affected endpoints; enable detailed audit logging of file uploads and administrator actions; implement server-side file upload validation; monitor and restrict PHP execution in upload directories; and establish continuous monitoring of Templately security advisories for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB