CVE-2026-18438

Name of the Vulnerable Software and Affected Versions Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! versions prior to 3.7.2

Description Authenticated attackers with contributor-level access and above can achieve remote code execution via the fetch remote file() function. The issue stems from a filename validation and destination mismatch where file type validation is performed against the attacker-controlled Content-Disposition filename instead of the destination filename derived from the URL path. This allows a GIF+PHP polyglot file (a file that is valid as both a GIF image and a PHP script) to bypass the unfiltered upload capability gate by appearing as an image while being saved with a .php extension. The affected API endpoints are '/templately/v1/clouds/upload', '/templately/v1/insert', and '/templately/v1/login'. The latter allows contributors to overwrite the global cloud connection by setting global signin to true. These endpoints are accessible due to an insufficient authorization check that only requires the delete posts capability rather than administrator-level permissions.

Recommendations Update the plugin to version 3.7.2 or later. Correct the fetch remote file() function to validate file types against the actual destination filename instead of the Content-Disposition header and stop deriving the write path from the request URL. Restrict state-changing REST routes to administrator-level capabilities.