CVE-2026-18438 describes a remote code execution vulnerability in the Templately – Elementor & Gutenberg Template Library WordPress plugin (up to and including version 3.7.1). The vulnerability arises from a mismatch in file validation within the fetch_remote_file function: the plugin validates the file type based on the Content-Disposition header filename, which is attacker-controlled, rather than the actual destination filename derived from the URL path. This allows an authenticated attacker with contributor-level privileges to upload a GIF+PHP polyglot file that passes validation as an image but is saved with a .php extension, enabling execution of arbitrary code on the server. The REST API endpoints involved (/templately/v1/clouds/upload, /templately/v1/insert, and /templately/v1/login) are protected only by a current_user_can('delete_posts') check, insufficiently restricting access. The vulnerability also allows overwriting the global Templately cloud connection. Remediation involves correcting file type validation to use the destination filename and restricting REST API routes to administrator-level capabilities.

An attacker with contributor-level access can upload and execute arbitrary PHP code on the server, leading to full compromise of the WordPress site. The vulnerability allows bypassing file upload restrictions and capability checks, enabling remote code execution and potential site takeover. Additionally, the attacker can overwrite the global cloud connection settings, potentially affecting site functionality or further persistence.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level users from accessing the vulnerable REST API endpoints if possible, and monitor for suspicious file uploads. A complete fix requires updating the plugin to validate file types against the actual destination filename and restricting sensitive REST API routes to administrator-level capabilities.