Description

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site's cloud template library to attacker-controlled content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-07T06:16:55.460Z",
  "pubdate": "2026-08-07T06:16:55.460Z",
  "executiveSummary": "The Templately WordPress plugin prior to version 3.7.1 suffers from an authorization bypass vulnerability affecting one of its request handlers. This security flaw enables unauthenticated remote attackers to execute unauthorized administrative actions targeting the application's cloud infrastructure integration.\nSpecifically, the vulnerability allows malicious actors to overwrite the legitimate administrator's stored cloud service connection with an attacker-controlled account. Consequently, this administrative redirection severs the authorized user's connection and reroutes the WordPress site's cloud template library to serve attacker-controlled content.\nThe risk implications are significant, as unauthorized manipulation of external template sources introduces potential supply chain and content injection vectors directly into the victim's WordPress environment. Exploitation requires no prior authentication or administrative privileges, relying entirely on network-accessible HTTP requests directed at the vulnerable request handler within the Templately plugin.\nMitigation requires immediate administrative action to update the affected product to version 3.7.1 or later, where proper access controls and authorization checks are enforced on the vulnerable request handler.",
  "technicalDetails": "The root cause of this vulnerability lies in the absence of robust authorization checks within a specific request handler implemented by the Templately WordPress plugin. In web application architecture, request handlers must rigorously validate both the identity and the privilege level of the incoming request's originator before processing state-changing operations.\nBecause the vulnerable handler lacks these validation checks, an unauthenticated remote attacker can issue a crafted HTTP request directly to the endpoint exposed by the plugin. Network exposure of this handler permits arbitrary ingestion of parameters designed to modify application-level configurations.\nThe step-by-step attack flow proceeds as follows: First, the unauthenticated attacker identifies or targets the unprotected request handler endpoint associated with the Templately plugin. Second, the attacker crafts an HTTP payload containing malicious parameters intended to redefine the stored cloud service connection credentials or tokens. Third, the attacker transmits this request over the network to the target WordPress installation. Fourth, the vulnerable request handler processes the unauthenticated input without verifying session tokens, user capabilities, or nonces. Fifth, the application overwrites the legitimate administrator's established cloud service connection parameters in the database with the attacker-supplied credentials.\nThe post-exploitation impact includes the immediate termination or hijacking of the legitimate administrator's cloud session, effectively locking out the authorized user from their rightful cloud integration state. Furthermore, because the application relies on this connection to fetch layout data, the site's integrated cloud template library is systematically redirected to load assets and content controlled by the attacker. This opens avenues for content spoofing or the potential injection of malicious layouts into posts and pages managed by the compromised WordPress instance.\nThe affected component is the request handler mechanism responsible for managing cloud service connections within versions of the Templately WordPress plugin prior to 3.7.1. Exploitation demands zero authentication and zero privileges, functioning entirely over standard network exposure vectors."
}