EUVD-2026-60908
GHSA-pxj2-g2c2-xm95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Contributor-level account
-
DeliveryAccess Templatiq upload feature
-
ExploitUpload PHP webshell past validation
-
ExecutionRequest uploaded file URL
-
PersistExecute code as web server user
-
ImpactFull site/server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account with at least Contributor privileges (CVSS PR:L) on a site running the Templatiq plugin at version 0.2.5 or earlier; no user interaction and no elevated admin role are needed. Exploitation depends on reaching the plugin's file-upload feature, so the practical limiting factor is whether untrusted parties can obtain Contributor+ accounts - sites with open registration or many low-trust authors are exposed, whereas single-author or closed-membership sites sharply reduce attacker access. No non-default plugin configuration is indicated as necessary in the available data beyond having the plugin installed and active. |
| Impact | The signals are strong but not fully corroborated across sources. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H = 9.9) indicates network-reachable, low-complexity exploitation requiring only Contributor authentication - a role many multi-author WordPress sites grant liberally - leading to full confidentiality, integrity, and availability loss. That combination makes it a genuine priority rather than a high-score-but-low-real-risk finding, and any operator running an untrusted-contributor WordPress deployment should treat it as urgent. However, EPSS and KEV data were not provided in the input, and no POC reference is present, so the probability and active-exploitation dimensions are unknown; the 9.9 rests on the vendor CVSS alone. The PR:L requirement is the main mitigating factor - this is not unauthenticated - so real-world risk concentrates on sites that expose Contributor (or higher) accounts to untrusted or self-registered users. |
| Exploit ScenarioDerived | An attacker registers or obtains a Contributor account on a WordPress site running Templatiq ≤ 0.2.5, then uses the plugin's upload functionality to submit a PHP webshell disguised or accepted past insufficient validation. They browse to the uploaded file's URL to execute code as the web server user, achieving remote code execution; the AV:N/AC:L/PR:L profile means this needs only a valid low-privilege login and no special timing or victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data; the EUVD entry shows no fixed release. Consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/templatiq/vulnerability/wordpress-templatiq-plugin-0-2-5-arbitrary-file-upload-vulnerability?_s_id=cve) for an updated fix and upgrade to any version above 0.2.5 once published. Until a fix is confirmed, the highest-value compensating control is to deactivate and remove the Templatiq plugin, which fully removes the vulnerable upload path at the cost of losing its template features. If the plugin must remain, restrict who holds Contributor-or-higher accounts and disable open user registration (Settings → General → 'Anyone can register') to remove the low-privilege attacker prerequisite. As defense-in-depth, deploy a WAF/virtual patch (Patchstack or equivalent) to block malicious upload requests, and enforce PHP execution denial in WordPress upload directories (e.g., an .htaccess/Nginx rule preventing execution under wp-content/uploads), noting this can break legitimate plugins that rely on executing files there.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Templatiq (vendor 'wpwax', CPE cpe:2.3:a:wpwax:templatiq) is a WordPress template/starter-site library plugin that runs inside the PHP-based WordPress stack. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): an upload handler exposed to low-privilege roles fails to enforce a safe extension/MIME allowlist or to store files outside the web root, so an attacker can place a script (typically a .php webshell) into a web-accessible directory. Because WordPress executes PHP from within its own tree, a successfully placed file is directly reachable over HTTP and runs as the web server user, which is why the vendor assigned a Scope:Changed vector.
Know when Templatiq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Contributor login gives PR:L over the network with no interaction (AC:L/UI:N); webshell RCE runs as the web-server user beyond the plugin boundary, justifying S:C and full C:H/I:H/A:H, though S:U (≈8.8) is defensible.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.
Executive ViewAI
The Templatiq WordPress plugin (versions 0.2.5 and earlier) contains a critical arbitrary file upload vulnerability allowing authenticated Contributor-level users to upload executable PHP files, enabling complete compromise of affected WordPress sites. Organizations using this plugin face immediate risk of website defacement, data theft, and operational disruption. No patch is currently available, and exploitation does not require administrator credentials, significantly expanding the attack surface.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) deactivate the Templatiq plugin immediately across all WordPress instances; (2) restrict or revoke file upload permissions for all Contributor-level and below user roles; (3) implement Web Application Firewall (WAF) rules to block executable file uploads to wp-content/uploads and other writable directories; (4) enable file integrity monitoring on upload directories to alert on new PHP files; (5) review and restrict PHP execution in upload directories via .htaccess or server configuration; (6) monitor Patchstack and official Templatiq channels for patch release announcements.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Exploit-DB