CVE-2026-0831mediumCWE-863

CVE-2026-0831: falha de média gravidade em wpdevteam Templately – Elementor & Gutenberg…

Templately <= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary `.ai.json` files to locations within the uploads directory.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
wpdevteam · Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud!
CVEs relacionadas — wpdevteam Templately – Elementor & Gutenberg…

No mesmo produto, das mais perigosas para as menos.

CVE-2026-18438HIGHTemplately <= 3.7.1 - Authenticated (Contributor+) Arbitrary File Upload to Remote Code Execution via Gutenberg Cloud Import Attachment Filename MismatchEPSS 1.3%