Remote Code Execution in Templately WordPress Plugin

The Templately - Elementor & Gutenberg Template Library plugin for WordPress (versions 3.7.1 and below) is susceptible to remote code execution (RCE) due to a flaw in the fetch_remote_file function. The plugin fails to validate file types against the actual destination path, instead relying on the attacker-controlled Content-Disposition header. An attacker with contributor-level permissions can craft a malicious GIF+PHP polyglot file that bypasses server-side checks. Because the plugin derives the final write path from the request URL, the file is saved with a .php extension rather than the expected image type. Furthermore, Templately's REST API endpoints (including those used for cloud imports) are improperly gated by the delete_posts capability, allowing users with low-level privileges to perform sensitive operations. This vulnerability significantly impacts WordPress sites using the plugin by providing a clear path to full system compromise for authenticated users.

Attack Chain

1. Attacker authenticates to the WordPress site with Contributor-level access or higher.
2. Attacker crafts a GIF/PHP polyglot file designed to bypass wp_check_filetype_and_ext validation.
3. Attacker sends a POST request to the vulnerable Templately REST API endpoint, specifically /templately/v1/clouds/upload.
4. The request includes a manipulated Content-Disposition header identifying the file as an image/gif to satisfy validation logic.
5. The fetch_remote_file function processes the request and writes the payload to the server.
6. Due to the destination path derivation flaw, the file is saved with a .php extension instead of an image extension.
7. Attacker triggers the uploaded PHP file via a direct HTTP request to the web server to achieve remote code execution.

Impact

Successful exploitation results in unauthorized remote code execution on the underlying web server. This allows an attacker to execute system commands, access the WordPress database, steal sensitive information, or further compromise the hosting environment. Organizations using Templately versions 3.7.1 or older are at risk of complete site takeover by any authenticated user with contributor-level access.

Recommendation

• Immediately update the Templately plugin to the latest available version to patch the fetch_remote_file validation logic.
• Audit WordPress user permissions to identify and restrict excessive contributor-level accounts.
• Deploy the provided web server detection rules to identify malicious requests targeting Templately REST API endpoints.
• Monitor web server logs for suspicious POST requests to /templately/v1/clouds/upload that result in unusual file extensions or requests from authenticated accounts with limited roles.