{"id":"CVE-2026-0831","aliases":["EUVD-2026-1852","GHSA-8643-3fq3-vwcr"],"status":"published","title":"Templately \u003c= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write","description":"The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary `.ai.json` files to locations within the uploads directory.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00271,"percentile":0.19433,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-01-10T09:22:18Z","modified":"2026-06-17T10:11:27Z","products":[{"vendor":"wpdevteam","product":"templately – elementor \u0026 gutenberg template library: 6500+ free \u0026 pro ready templates and cloud!"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/778242f4-5dfa-4d72-a032-8b5521c5b8ce?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.4.5/includes/Core/Importer/Utils/AIUtils.php#L414"},{"url":"https://plugins.trac.wordpress.org/browser/templately/tags/3.4.5/includes/API/AIContent.php#L38"},{"url":"https://plugins.trac.wordpress.org/changeset/3426051/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0831"},{"url":"https://plugins.trac.wordpress.org/changeset/3426051"},{"url":"https://github.com/advisories/GHSA-8643-3fq3-vwcr"}],"sources":{"cve":[{"id":"CVE-2026-0831","title":"Templately \u003c= 3.4.8 - Unauthenticated Limited Arbitrary JSON File Write","description":"The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary `.ai.json` files to locations within the uploads directory.","status":"published","published":"2026-01-10T09:22:18.126Z","modified":"2026-04-08T17:01:43.379Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:20:13.587351Z"}],"euvd":[{"id":"EUVD-2026-1852","description":"The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary `.ai.json` files to locations within the uploads directory.","status":"published","published":"2026-01-10T09:22:18Z","modified":"2026-04-08T17:01:43Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:52.902902Z"}],"ghsa":[{"id":"GHSA-8643-3fq3-vwcr","title":"The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to,...","description":"The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary `.ai.json` files to locations within the uploads directory.","status":"published","published":"2026-01-10T12:30:16Z","modified":"2026-01-10T12:30:22Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:05:34.043335Z"}],"nvd":[{"id":"CVE-2026-0831","description":"The Templately plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.4.8. This is due to inadequate input validation in the `save_template_to_file()` function where user-controlled parameters like `session_id`, `content_id`, and `ai_page_ids` are used to construct file paths without proper sanitization. This makes it possible for unauthenticated attackers to write arbitrary `.ai.json` files to locations within the uploads directory.","status":"published","published":"2026-01-10T10:15:50.96Z","modified":"2026-06-17T10:11:27.557Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:03.683495Z"}]}}