CVE-2026-18438 affects the Templately – Elementor & Gutenberg Template Library WordPress plugin up to version 3.7.1. The vulnerability is a Remote Code Execution (RCE) caused by a mismatch in file type validation within the fetch_remote_file function. The plugin validates the file type against the Content-Disposition header filename, which an attacker controls, rather than the actual destination filename derived from the URL path. This allows an attacker with contributor-level privileges to upload a GIF+PHP polyglot file that passes image validation but is saved with a .php extension, enabling code execution on the server. The REST API endpoints involved (/templately/v1/clouds/upload, /templately/v1/insert, and /templately/v1/login) are protected only by a current_user_can('delete_posts') check, which is insufficient to prevent exploitation. The vulnerability also allows overwriting the global Templately cloud connection. A complete fix requires validating file types against the destination filename and restricting REST API routes to administrator-level capabilities.

An authenticated attacker with contributor-level access or higher can execute arbitrary code on the server by uploading a specially crafted file that bypasses file type validation. This can lead to full compromise of the affected WordPress site, including data theft, site defacement, or further pivoting within the hosting environment. The insufficient permission checks on REST API endpoints increase the attack surface by allowing contributors to perform actions normally reserved for administrators.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or restricting access to the Templately plugin's REST API endpoints if possible. Monitor for updates from the vendor that address validation of file uploads and tighten permission checks on REST API routes to require administrator-level capabilities.