Description

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Content-Disposition filename rather than the URL-path-derived destination filename. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. A GIF+PHP polyglot file passes wp_check_filetype_and_ext validation as image/gif via the Content-Disposition filename, while the actual destination path is written with a .php extension derived from the URL path, bypassing the unfiltered_upload capability gate entirely. The affected endpoints are reachable at this privilege level because Templately's entire REST API — including the cloud import endpoints used in this attack (/templately/v1/clouds/upload and /templately/v1/insert) — is authorized only by a current_user_can('delete_posts') check, with no administrator or manage_options capability requirement. The same permission gate also allows a contributor to overwrite the site's global Templately cloud connection via the /templately/v1/login endpoint with global_signin set to true. A complete remediation should both correct fetch_remote_file to validate the file type against the actual destination filename rather than the Content-Disposition header (and avoid deriving the write path from the request URL), and restrict state-changing Templately REST routes to an appropriate administrator-level capability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T10:16:29.413Z",
  "pubdate": "2026-08-15T10:16:29.413Z",
  "executiveSummary": "The Templately – Elementor & Gutenberg Template Library plugin for WordPress is vulnerable to Remote Code Execution across all versions up to, and including, 3.7.1 via the fetch_remote_file function.\nThis security flaw arises due to a filename validation and destination mismatch in fetch_remote_file, allowing authenticated attackers with contributor-level access and above to execute arbitrary code on the underlying server.\nThe impact of this vulnerability is severe, leading to complete compromise of the affected WordPress site.\nExploitation requires authenticated access with contributor-level privileges or higher, leveraging overly permissive REST API authorization checks that only require a current_user_can('delete_posts') capability rather than administrator-level oversight.\nAttackers can leverage this flaw by sending specially crafted requests to the plugin REST API endpoints, bypassing the unfiltered_upload capability gate entirely through a crafted GIF+PHP polyglot file.",
  "technicalDetails": "The vulnerability resides in the fetch_remote_file function within the Templately – Elementor & Gutenberg Template Library plugin for WordPress, affecting all versions up to, and including, 3.7.1.\nThe root cause of the vulnerability is a filename validation and destination mismatch in fetch_remote_file. Specifically, file type validation via wp_check_filetype_and_ext is performed against the attacker-controlled Content-Disposition filename rather than the actual URL-path-derived destination filename.\nAn authenticated attacker with contributor-level access and above can exploit this flaw by leveraging the plugin REST API endpoints, specifically /templately/v1/clouds/upload and /templately/v1/insert, which are reachable at this privilege level because Templately authorization relies solely on a current_user_can('delete_posts') check without enforcing an administrator or manage_options capability requirement.\nDuring the attack flow, a malicious user submits a GIF+PHP polyglot file. The file successfully passes the wp_check_filetype_and_ext validation as an image/gif based on the Content-Disposition filename. However, the actual destination path is written with a .php extension derived from the URL path, effectively bypassing the unfiltered_upload capability gate.\nAdditionally, the same permissive permission gate allows a contributor-level user to overwrite the site's global Templately cloud connection via the /templately/v1/login endpoint with global_signin set to true.\nPost-exploitation impact includes arbitrary code execution on the server hosting the WordPress instance, potentially allowing full system compromise, data exfiltration, or further lateral movement within the network environment."
}