CVE-2026-15359 Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite
Unauthenticated attackers can overwrite administrator cloud connections in Templately, redirecting template libraries to attacker-controlled content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-15359?
CVE-2026-15359 is a medium-severity missing authorization vulnerability in Unknown Templately, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site's cloud template library to attacker-controlled content.
Weakness: CWE-862
Which versions are affected by CVE-2026-15359?
How do I fix CVE-2026-15359?
No fix has been published for CVE-2026-15359 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-15359 being exploited?
There is no known exploitation of CVE-2026-15359 in the wild and no public exploit code.
Sources
Also known as GHSA-4vxc-ggfm-6c86.