CVE-2026-0831: Templately Path Traversal Vulnerability

CVE-2026-0831 Overview

The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This vulnerability stems from inadequate input validation in the save_template_to_file() function where user-controlled parameters like session_id, content_id, and ai_page_ids are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary .ai.json files to locations within the uploads directory.

Critical Impact

Unauthenticated attackers can write arbitrary files to the WordPress uploads directory, potentially leading to further exploitation such as defacement, data manipulation, or serving as a stepping stone for more severe attacks.

Affected Products

• Templately WordPress Plugin versions up to and including 3.4.8

Discovery Timeline

• 2026-01-10 - CVE CVE-2026-0831 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-0831

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), indicating a failure to properly validate user permissions before allowing file write operations. The vulnerability affects the Templately plugin's AI content functionality, specifically within the template file saving mechanism.

The core issue lies in the save_template_to_file() function which accepts user-supplied input for constructing file paths. When user-controlled parameters such as session_id, content_id, and ai_page_ids are incorporated into the file path without adequate sanitization, attackers can manipulate these values to write files to unintended locations within the WordPress uploads directory.

Since the vulnerability requires no authentication (network accessible with no privileges required), any remote attacker can exploit this flaw to write malicious .ai.json files. While the file extension is restricted, the ability to write arbitrary content to predictable locations within the uploads directory poses significant risks for further exploitation chains.

Root Cause

The root cause of this vulnerability is insufficient input validation and sanitization of user-controllable parameters used in file path construction. The save_template_to_file() function in the AIUtils component trusts user input for session_id, content_id, and ai_page_ids parameters without properly validating or sanitizing these values before using them to determine where files are written on the server.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send specially crafted requests to the vulnerable endpoint with manipulated parameter values. The vulnerable code paths can be examined in the WordPress Templately API Code and WordPress Templately AI Utils Code.

The exploitation flow involves:

1. Attacker identifies a WordPress site running a vulnerable version of Templately
2. Attacker crafts a request to the AI content endpoint with malicious path traversal characters or manipulated identifiers in the session_id, content_id, or ai_page_ids parameters
3. The server processes the request and writes an .ai.json file to an attacker-controlled location within the uploads directory

Detection Methods for CVE-2026-0831

Indicators of Compromise

• Unexpected .ai.json files appearing in the WordPress uploads directory or subdirectories
• Unusual HTTP POST requests to Templately plugin endpoints containing path traversal sequences (e.g., ../) in parameters
• Web server logs showing requests with suspicious session_id, content_id, or ai_page_ids parameter values
• Modified file timestamps in the uploads directory that don't correspond to legitimate user activity

Detection Strategies

• Monitor web application firewall (WAF) logs for requests targeting /wp-content/plugins/templately/ with unusual parameter patterns
• Implement file integrity monitoring (FIM) on the WordPress uploads directory to detect unauthorized file creation
• Review Apache/Nginx access logs for anomalous POST requests to the Templately AI content endpoints
• Deploy intrusion detection rules that alert on path traversal attempts in HTTP parameters

Monitoring Recommendations

• Configure real-time alerting for new file creation events within the WordPress uploads directory hierarchy
• Implement regular security scans to identify outdated WordPress plugins including Templately
• Set up log aggregation to correlate access attempts across multiple WordPress installations
• Enable verbose logging on WordPress to capture detailed plugin activity

How to Mitigate CVE-2026-0831

Immediate Actions Required

• Update the Templately plugin to a version newer than 3.4.8 immediately
• Audit the WordPress uploads directory for any suspicious .ai.json files that may have been created by attackers
• Review web server logs for evidence of exploitation attempts
• If compromise is suspected, perform a complete forensic analysis of the WordPress installation

Patch Information

A security fix has been released by the plugin developers. The patch can be reviewed in WordPress Changeset #3426051. Additional vulnerability details are available in the Wordfence Vulnerability Report.

Update the plugin through the WordPress admin dashboard or via WP-CLI to receive the security fix.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the Templately plugin until the update can be applied
• Implement web application firewall (WAF) rules to block requests containing path traversal sequences in plugin parameters
• Restrict direct access to the Templately plugin API endpoints at the web server level
• Apply file system permissions to limit write access to the uploads directory where possible

# WP-CLI command to update Templately plugin
wp plugin update templately

# Verify current installed version
wp plugin list --name=templately --fields=name,version,status