Product
Authenticated contributors can execute arbitrary code via the Templately plugin by bypassing file type validation through a GIF/PHP polyglot file.