CVE-2026-15359

Executive Summary

CVE-2026-15359 is a missing authorization vulnerability in the Templately WordPress plugin, affecting all versions prior to 3.7.1. An unauthenticated remote attacker can exploit an unprotected request handler to overwrite the administrator's stored cloud service connection, substituting it with attacker-controlled credentials. This allows the attacker to disconnect the legitimate administrator from their Templately cloud account, redirect the site's cloud template library to attacker-controlled content, and potentially inject malicious templates into the site's workflow. The vulnerability carries a CVSS score of 6.5 (Medium), with network attack vector, low attack complexity, no privilege requirements, and no user interaction needed.

Technical Analysis

The Templately plugin (versions < 3.7.1) implements a cloud-based template library that synchronises with the Templately SaaS platform. This integration requires the WordPress administrator to authenticate with their Templately cloud account, and the plugin stores the connection token/credentials in the WordPress options table (typically as a serialised option such as templately_cloud_connection or similar).

The vulnerability stems from a missing capability/authorization check (current_user_can() or equivalent) on one of the plugin's AJAX or REST API request handlers. The plugin registers request handlers — commonly via WordPress's wp_ajax_ and wp_ajax_nopriv_ action hooks, or through REST API routes with incorrect permission callbacks — to manage the cloud connection. One such handler is responsible for updating or replacing the stored cloud connection parameters.

The flaw is specifically that this handler is registered for both authenticated and unauthenticated users (via the nopriv variant) or the REST route lacks an is_user_logged_in() permission check. Since the handler does not verify whether the requesting user has manage_options capability (or any administrator-level permission), an unauthenticated attacker can send a crafted HTTP request to the handler endpoint. The handler then writes arbitrary connection data (attacker-controlled service endpoint and authentication credentials) into the WordPress options table.

The attack mechanism is as follows:

• The vulnerable endpoint accepts parameters such as api_key, api_url, token, or similar fields that define the cloud service connection.
• The handler processes these parameters and calls update_option() (or an equivalent) to store them.
• Because no authorization check exists, any incoming request — authenticated or not — causes the option to be overwritten.

After exploitation, the legitimate administrator's stored cloud connection is replaced. The site's template library now points to attacker-controlled infrastructure. If the plugin fetches templates from the configured endpoint, the attacker can serve malicious template content that, when imported by site editors, could execute PHP code or inject stored XSS payloads (depending on how templates are handled by the plugin's import/render logic).

The absence of a CSRF check compounds the issue, but the primary vulnerability remains the missing authorization. The attack requires no user interaction and no prior authentication, making it trivially exploitable via a single HTTP request. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L reflects:

• Integrity impact (Low): Attacker can modify the plugin's cloud connection configuration and potentially inject malicious content into the site's template library.
• Availability impact (Low): The legitimate administrator is disconnected from their cloud service, potentially breaking template synchronisation and cloud-based features.
• Confidentiality impact (None): No direct data exfiltration via this flaw; however, attacker-controlled templates could later be used to steal credentials if they contain malicious PHP code.

Exploitation Scenarios

The following attack chain demonstrates how an attacker would exploit CVE-2026-15359 against a target WordPress site running Templately < 3.7.1:

Step 1 — Reconnaissance / Target Identification

1. The attacker uses Shodan or Google dorking (inurl:"wp-content/plugins/templately") to identify WordPress sites running the Templately plugin.
2. The attacker fingerprints the plugin version by fetching wp-content/plugins/templately/readme.txt and parsing the "Stable tag" field, or by checking for known release markers in the plugin's main PHP file header.
3. Sites with version < 3.7.1 are shortlisted as vulnerable targets.

Step 2 — Endpoint Discovery / Trigger

1. The attacker enumerates the plugin's AJAX actions by examining the plugin's source (downloaded from the WordPress plugin repository) or by triggering common action names. The vulnerable handler likely uses an action such as templately_connect_cloud, templately_update_connection, or templately_save_settings.
2. The attacker sends a POST request to /wp-admin/admin-ajax.php with:
   • action=templately_connect_cloud (or the specific vulnerable action name)
   • api_key=attacker_controlled_api_key
   • api_url=https://attacker.example.com/
   • token=attacker_controlled_token
3. Alternatively, if the handler is a REST route, the attacker sends a POST request to /wp-json/templately/v1/connect with the connection parameters in the request body. The lack of a permission callback (register_rest_route() with missing permission_callback argument or one that always returns true) allows unauthenticated access.

Step 3 — Payload / Execution

1. The server processes the request without checking current_user_can('manage_options') or verifying nonce validity.
2. The plugin's handler calls update_option('templately_cloud_connection', $attacker_data) where $attacker_data contains the attacker's API key and endpoint URL.
3. The legitimate administrator's previous connection data is silently replaced. No integrity check, existing-value validation, or admin notification occurs.

Step 4 — Post-Exploitation Impact

1. The legitimate administrator loses access to their Templately cloud account from this site. When the admin attempts to use the cloud template library, the plugin attempts to connect to https://attacker.example.com/ with the attacker's API key.
2. The attacker configures their server to respond to API calls from the target site with crafted template data. These templates may contain:
   • PHP backdoors (if the import logic renders PHP in template files).
   • Stored XSS payloads (if templates are injected into the WordPress editor without sanitisation).
   • Malicious redirects or iFrame injectors embedded in template HTML.
3. When site editors or the admin import templates from the library, the malicious content executes. If code execution is achieved, the attacker gains a foothold for lateral movement, credential harvesting (via reading wp-config.php), or full site takeover (by creating a new admin user).
4. If no editors interact with templates post-attack, the attacker has at minimum disrupted cloud service availability and poisoned the plugin's configuration — creating a persistent integrity compromise that is invisible until the plugin attempts to sync.

For maximum impact, the attacker can chain this with a stored XSS payload in a template that triggers when any admin visits the template library page, achieving full admin account compromise without direct code execution.

Impact Assessment

Business Impact:

• Integrity compromise (CVSS I:L): The site's cloud service configuration is overwritten with attacker-controlled values. The legitimate admin's Templately account is disconnected, and the template library content is attacker-controlled. Any future template imports are untrusted.
• Availability degradation (CVSS A:L): Cloud template synchronisation fails; editors lose access to legitimate templates. In a worst case, if malicious templates cause PHP fatal errors during import, the editor/admin backend could malfunction.
• Supply-chain risk: The plugin acts as a bridge between the site and a cloud SaaS provider. By controlling that bridge, the attacker controls a portion of the site's content creation pipeline. This is particularly dangerous for agencies managing multiple client sites via Templately, as one compromised site could expose credentials or templates used across the fleet.
• No confidentiality impact on its own, but the attacker-controlled content can be used to harvest credentials, customer data, or perform phishing from the legitimate site domain.

Affected Systems:

• All WordPress installations running Templately < 3.7.1, regardless of hosting provider, theme, or co-installed plugins.
• The vulnerability is present in both the free and pro versions if the pro version shares the same codebase and version numbering (the CVE description does not differentiate).

Blast Radius:

• Single-site takeover if malicious templates achieve code execution.
• Multi-site/agency compromise if shared cloud connection tokens are reused across client sites.
• SEO poisoning and malware distribution if the attacker injects content that is indexed or served to site visitors.

CVSS Subscore Rationale:

• Attack Vector: Network — remotely exploitable over HTTP.
• Attack Complexity: Low — no special conditions; a single HTTP request triggers the flaw.
• Privileges Required: None — unauthenticated exploitation.
• User Interaction: None — no victim action required to trigger the overwrite.
• Scope: Unchanged — the compromise is confined to the plugin's data, not the underlying OS or adjacent components.
• Integrity: Low — configuration file overwrite, but not arbitrary file write.
• Availability: Low — service disruption of the cloud template feature.

Detection Guidance

Sigma Rule

title: CVE-2026-15359 Templately Cloud Connection Overwrite Attempt
id: 7c8f3b2a-9d4e-4f6b-8c1a-5d2e3f4a5b6c
status: experimental
description: Detects unauthenticated POST requests to WordPress admin-ajax.php or REST API targeting Templately cloud connection handlers.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15359
author: Valtersit Threat Intelligence
date: 2026/05/15
logsource:
    category: webserver
    product: apache
    definition: 'WordPress site with Templately plugin installed'
detection:
    selection_ajax:
        cs-method: POST
        cs-uri-query|contains:
            - 'action=templately_connect_cloud'
            - 'action=templately_update_connection'
            - 'action=templately_save_cloud_settings'
    selection_rest:
        cs-uri-stem|startswith: '/wp-json/templately/v1/'
    selection_body:
        cs-body|contains|all:
            - 'api_key'
            - 'api_url'
    condition: (selection_ajax or selection_rest) and selection_body
    timeframe: 5m
level: high
falsepositives:
    - Legitimate admin reconnecting the cloud service (rare; should originate from admin IP)
fields:
    - src_ip
    - cs-uri-query
    - cs-body

YARA Rule

rule CVE_2026_15359_Templately_Exploit
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP requests targeting vulnerable Templately cloud connection endpoints"
        date = "2026-05-15"
        cve = "CVE-2026-15359"
        severity = "high"
    strings:
        $ajax_action1 = "action=templately_connect_cloud" ascii wide nocase
        $ajax_action2 = "action=templately_update_connection" ascii wide nocase
        $ajax_action3 = "action=templately_save_cloud_settings" ascii wide nocase
        $rest_path = "/wp-json/templately/v1/" ascii wide nocase
        $param_key = "api_key" ascii wide nocase
        $param_url = "api_url" ascii wide nocase
        $param_token = "token" ascii wide nocase
    condition:
        uint16(0) == 0x0d0a and
        (any of ($ajax_action*) or $rest_path) and
        ($param_key or $param_url or $param_token) and
        filesize < 10KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-15359 Templately Cloud Connection Overwrite Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; nocase; http.uri; content:"action=templately"; nocase; http.request_body; content:"api_key"; nocase; http.request_body; content:"api_url"; nocase; pcre:"/action=(templately_connect_cloud|templately_update_connection|templately_save_cloud_settings)/iU"; sid:90215359; rev:1; classtype:web-application-attack; reference:cve,2026-15359; priority:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [network where event.action == "connection_attempted" and destination.port == 443 and network.protocol == "https"]
  [http where event.action == "request" and http.request.method == "POST" and
   ( http.request.uri contains "admin-ajax.php" and http.request.body.content contains "action=templately" or
     http.request.uri starts_with "/wp-json/templately/v1/" ) and
   http.request.body.content contains "api_key" and
   http.request.body.content contains "api_url" and
   not source.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")]

Splunk SPL Query

index=web sourcetype=apache:access
| where like(uri, "%admin-ajax.php%") OR like(uri, "%wp-json/templately%")
| search method=POST
| rex field=uri "action=(?<action>[^&]+)"
| rex field=form_data "api_key=(?<api_key>[^&]+)"
| rex field=form_data "api_url=(?<api_url>[^&]+)"
| search action IN ("templately_connect_cloud", "templately_update_connection", "templately_save_cloud_settings") OR uri LIKE "%/wp-json/templately/v1/%"
| where isnotnull(api_key) AND isnotnull(api_url)
| stats count by src_ip, uri, action, _time
| sort - _time
| limit 100

Wazuh OSSEC Rule

<group name="wordpress,templately,">
  <rule id="151985" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.admin-ajax\.php</field>
    <field name="action">templately_connect_cloud|templately_update_connection|templately_save_cloud_settings</field>
    <description>CVE-2026-15359: Templately cloud connection overwrite attempt (action: $(action))</description>
    <group>attack.medium,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="151986" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">^/wp-json/templately/v1/</field>
    <field name="method">POST</field>
    <description>CVE-2026-15359: Templately REST API unauthenticated connection modification</description>
    <group>attack.medium,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source claims patch (not independently confirmed). NVD references version 3.7.1 as the patched release, but the vendor advisory has not been independently verified by a second source or security researcher. Validate the patch in your environment before broad deployment.

1) Immediate Mitigations (before patching):

• Disable or deactivate the Templately plugin until it can be upgraded. If the site relies on Templately for design workflows, schedule a maintenance window to apply the patch quickly.
• If deactivation is not possible, restrict access to /wp-admin/admin-ajax.php and /wp-json/templately/ endpoints using a Web Application Firewall (WAF) rule or server-level .htaccess / nginx configuration to allow only authenticated requests from known admin IP ranges.
• Add a WAF virtual patch blocking POST requests to admin-ajax.php where the action parameter matches templately_* and the request originates from an unauthenticated source (no valid WordPress session cookie).
• Audit WordPress user accounts and remove any suspicious or dormant admin users that may have been created before you applied mitigations.

2) Patch / Upgrade Steps:

• Update the Templately plugin to version 3.7.1 or later via the WordPress admin dashboard (Plugins → Installed Plugins → Templately → Update Now), or via WP-CLI: wp plugin update templately.
• After updating, verify the plugin version in wp-content/plugins/templately/templately.php (check the Version: header) or via WP-CLI: wp plugin get templately.
• Clear object cache (if a caching plugin is in use) and verify that the stored cloud connection option in the database points to the legitimate Templately service endpoint (https://templately.com or the official API domain). Check with: wp option get templately_cloud_connection.
• If the connection was already overwritten, re-authenticate the legitimate Templately account via the plugin's settings page and rotate any API keys associated with the compromised account.

3) Long-Term Hardening:

• Implement the principle of least privilege for WordPress plugins: deny unauthenticated access to any plugin AJAX/REST endpoints via a security plugin (e.g., Wordfence, Sucuri) or server-side rules.
• Regularly audit plugin and theme updates; subscribe to the WordPress plugin security mailing list and CVE advisories (e.g., WPScan, Patchstack).
• Enable WordPress security logging and ship logs (Apache/nginx access logs, PHP error logs) to a SIEM (Splunk, Elastic, Wazuh) for continuous monitoring of the detection rules above.
• Establish a patch management SLA: critical WordPress plugin vulnerabilities should be patched within 48 hours of public disclosure for internet-facing sites.
• Harden the WordPress installation: disable file editing via DISALLOW_FILE_EDIT, restrict admin access by IP where possible, enforce strong admin passwords, and enable two-factor authentication for all administrative accounts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-15359 — Official CVE record with CVSS vector, description, and patch reference (version 3.7.1).
2. WordPress Plugin Repository: https://wordpress.org/plugins/templately/ — Official plugin page; changelog for version 3.7.1 contains the security fix details.
3. Patchstack Vulnerability Database (if available): https://patchstack.com/database/vulnerability/templately — Independent vulnerability disclosure platform that may carry the researcher's technical write-up and proof-of-concept details.
4. WPScan Vulnerability Database: https://wpscan.com/vulnerability/ — Search for CVE-2026-15359 or "Templately" for additional scanning and detection coverage details.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: As of the publication date, there are no publicly documented threat actor campaigns actively exploiting CVE-2026-15359. The vulnerability has a public PoC/exploit reference, and the CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the public availability of exploit details materially increases the likelihood of opportunistic exploitation by botnets and low-skill attackers within 30–60 days of disclosure. Security teams are advised to treat this as a priority medium-risk finding and apply the patch immediately.