Templatiq
Monthly
Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file upload in the Templatiq WordPress plugin (versions ≤ 0.2.5) lets authenticated users holding only Contributor-level privileges upload files without adequate type or content validation (CWE-434), enabling upload of executable PHP and full site compromise. The flaw was reported by Patchstack and carries a vendor CVSS of 9.9 driven by a scope change and low privilege barrier. No public exploit identified at time of analysis, and it is not listed in CISA KEV.