What is the CVSS score of CVE-2026-57658?

CVE-2026-57658 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of TemplateSpare are affected by CVE-2026-57658?

TemplateSpare WordPress plugin versions 4.2.0 and earlier suffer from a critical file upload vulnerability that enables Administrator users to deploy executable code, potentially compromising entire…

How to fix or mitigate CVE-2026-57658?

Within 24 hours: Audit all TemplateSpare installations for versions 4.2.0 or earlier; disable the plugin immediately if non-critical. Within 7 days: Restrict Administrator role to minimum necessary personnel, implement web server rules blocking PHP uploads in wp-content/uploads directory, and enable comprehensive logging of Administrator actions. Within 30 days: Evaluate alternative WordPress plugins or request vendor patch timeline; if no patch forthcoming, execute migration plan to patched alternative or implement network isolation.

TemplateSpare CVE-2026-57658

EUVD-2026-39663 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-26 audit@patchstack.com

GHSA-98gc-mw7m-prrh

WordPress File Upload Wordpress Plugin

9.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Admin-only upload sets PR:H with AV:N/AC:L/UI:N; webshell RCE yields C/I/A:H, but the compromise stays within the same WordPress host so S:U rather than S:C.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:46 vuln.today

DescriptionCVE.org

Administrator Arbitrary File Upload in TemplateSpare <= 4.2.0 versions.

AnalysisAI

Arbitrary file upload in the TemplateSpare WordPress plugin (versions 4.2.0 and earlier) allows an authenticated administrator-level user to upload files of dangerous types, enabling deployment of a PHP web shell and full server compromise. The flaw was reported by Patchstack and carries a CVSS of 9.1, but exploitation requires existing high-privilege (Administrator) access. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

TemplateSpare is a WordPress starter-template/import plugin used to bootstrap site designs. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): an upload handler that does not adequately validate file extension, MIME type, or content, permitting executable PHP to land in a web-accessible path. Because WordPress executes PHP within the document root, a successfully uploaded script runs in the web server context, turning a file write into remote code execution. No CPE strings were supplied in the input; affected scope is derived from the Patchstack advisory naming the plugin slug 'templatespare' at versions <= 4.2.0.

RemediationAI

No vendor-released patch version was identified in the provided data; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/templatespare/vulnerability/wordpress-templatespare-plugin-4-2-0-arbitrary-file-upload-vulnerability?_s_id=cve) and the WordPress.org plugin page for an updated release above 4.2.0 and upgrade as soon as one is available. As compensating controls until a fix is confirmed: restrict the number of Administrator accounts and enforce strong MFA on them since exploitation needs admin privileges; if TemplateSpare is not actively in use, deactivate and remove the plugin (trade-off: loses template-import functionality); harden the upload/storage directory by disabling PHP execution in wp-content upload paths via web-server config or .htaccess 'php_admin_flag engine off' (trade-off: may break other plugins that legitimately execute in those paths); and deploy a WAF/virtual patch (e.g., Patchstack) to block dangerous-type uploads. Note these mitigations reduce but do not eliminate risk from a fully trusted, malicious administrator.