Threats Tagged 'cve-2026-18438'

The Templately plugin for WordPress versions up to 3.7.1 contains a vulnerability that allows authenticated users with contributor-level access or higher to execute remote code on the server. This occurs due to improper validation of uploaded file types in the fetch_remote_file function, where validation is done against a user-controlled Content-Disposition filename rather than the actual destination filename. This flaw enables attackers to upload a polyglot file that passes image validation but is saved with a .php extension, bypassing security checks. Additionally, REST API endpoints controlling this functionality are protected only by a delete_posts capability check, which is insufficiently restrictive. No official patch or remediation guidance is currently available.