CVE-2026-32474: Templatiq Path Traversal Vulnerability

CVE-2026-32474 Overview

CVE-2026-32474 is an arbitrary file upload vulnerability in the Templatiq WordPress plugin affecting versions 0.2.5 and earlier. The flaw allows authenticated users with Contributor-level privileges to upload files without proper validation of file type or content [CWE-434]. Successful exploitation gives an attacker code execution on the underlying web server through uploaded PHP payloads. The vulnerability changes scope, meaning a compromised low-privilege WordPress account can impact the broader hosting environment.

Critical Impact
A Contributor account can upload arbitrary files to a WordPress site running Templatiq <= 0.2.5, leading to remote code execution and full site compromise.

Affected Products

Templatiq WordPress plugin versions <= 0.2.5
WordPress installations that grant Contributor or higher roles to untrusted users
Multi-author WordPress environments using the vulnerable plugin

Discovery Timeline

2026-08-18 - CVE-2026-32474 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-32474

Vulnerability Analysis

The vulnerability resides in a file upload handler exposed by the Templatiq plugin. The handler is reachable by authenticated users holding the Contributor role, a role that WordPress normally restricts to drafting posts. The plugin fails to enforce restrictions on the type, extension, or content of uploaded files. An attacker can upload executable server-side code, such as a PHP web shell, into a directory served by the web server.

The issue is classified under CWE-434: Unrestricted Upload of File with Dangerous Type. Because the flaw crosses a trust boundary from a low-privileged WordPress role into arbitrary code execution on the host, it results in a scope change and full compromise of confidentiality, integrity, and availability.

Root Cause

The plugin's upload endpoint accepts user-supplied files without validating extensions against an allow-list, without verifying MIME type from file content, and without enforcing capability checks appropriate to the sensitivity of the action. Contributor accounts, which are not intended to publish media or execute privileged operations, retain access to the vulnerable endpoint.

Attack Vector

Exploitation proceeds over the network against the WordPress admin interface. An attacker authenticates as a Contributor, submits a crafted upload request to the vulnerable Templatiq endpoint, and places a PHP file in a web-accessible location. The attacker then requests the uploaded file directly, triggering execution under the web server user. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2026-32474

Indicators of Compromise

Unexpected .php, .phtml, or .phar files inside wp-content/uploads/ or Templatiq-managed directories
Contributor accounts issuing POST requests to Templatiq upload endpoints
Outbound network connections originating from the PHP-FPM or web server process to unknown hosts
New or unrecognized administrator accounts created shortly after upload activity

Detection Strategies

Audit installed plugins and flag Templatiq versions at or below 0.2.5
Alert on file uploads by non-administrator roles that produce executable extensions
Monitor WordPress access.log for requests to uploaded files under /wp-content/uploads/ with a .php extension
Correlate Contributor-role authentication events with subsequent upload requests and shell-like URI patterns

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ and plugin directories
Forward WordPress audit logs to a centralized SIEM for role-based upload analysis
Track process execution on the web host for php spawning shell utilities such as sh, bash, wget, or curl

How to Mitigate CVE-2026-32474

Immediate Actions Required

Update the Templatiq plugin to a version later than 0.2.5 as soon as a fixed release is available
Disable or remove the Templatiq plugin if no patched version is installed
Review all Contributor and higher accounts for signs of compromise and reset credentials
Inspect wp-content/uploads/ and remove any unauthorized executable files

Patch Information

Refer to the Patchstack advisory for CVE-2026-32474 for the current patch status and vendor guidance. Apply the vendor-supplied update through the WordPress plugin manager once released.

Workarounds

Restrict the Contributor role or temporarily remove untrusted Contributor accounts until the plugin is patched
Configure the web server to deny execution of PHP files within wp-content/uploads/ using directory-level rules
Deploy a web application firewall rule that blocks uploads of executable file extensions to Templatiq endpoints

bash

# Deny PHP execution inside uploads directory (Apache .htaccess)
<FilesMatch "\.(php|phtml|phar|php7|php8)$">
    Require all denied
</FilesMatch>