PT-2026-2031 · WordPress · Templately

Wpdevteam · Publicado 2026-01-10 · Atualizado 2026-01-10 · CVE-2026-0831

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Templately versions prior to 3.4.9

Description The Templately plugin for WordPress is susceptible to an arbitrary file write issue. This is a result of insufficient input validation within the save template to file() function. User-controlled parameters, including session id, content id, and ai page ids, are utilized to create file paths without appropriate sanitization. This allows unauthenticated attackers to write arbitrary .ai.json files to locations within the uploads directory.

Recommendations Update to Templately version 3.4.9 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-0831

Produtos afetados

Templately

Referências · 8

• https://twitter.com/VulmonFeeds/status/2009961434000609321 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/templately/tags/3.4.5/includes/API/AIContent.php#L38 · Nota
• https://twitter.com/CVEnew/status/2009926039774880054 · Publicação no Twitter
• https://t.me/CVEtracker/41941 · Publicação no Telegram
• https://plugins.trac.wordpress.org/changeset/3426051 · Nota
• https://plugins.trac.wordpress.org/browser/templately/tags/3.4.5/includes/Core/Importer/Utils/AIUtils.php#L414 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/778242f4-5dfa-4d72-a032-8b5521c5b8ce?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0831 · Nota de Segurança