CVE-2026-15359 is a vulnerability in the Templately WordPress plugin prior to version 3.7.1 where one of its request handlers lacks proper authorization checks. This flaw permits unauthenticated attackers to overwrite the administrator's cloud service connection credentials, effectively disconnecting the legitimate administrator and redirecting the site's cloud template library to content controlled by the attacker. The vulnerability is classified under CWE-862 (Missing Authorization).

The vulnerability allows an unauthenticated attacker to modify the administrator's cloud service connection, leading to loss of control over the site's cloud template library. This can result in the administrator being disconnected and the site serving attacker-controlled content, impacting the integrity and availability of the cloud template service. Confidentiality is not directly impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor for updates from the Templately plugin vendor and apply any official patches once available. Until then, restricting access to the affected request handlers or disabling the plugin may reduce exposure.