The vulnerability exists in the Templately WordPress plugin before version 3.7.1. A request handler does not perform an authorization check, enabling an unauthenticated attacker to overwrite the administrator’s stored cloud service connection with an account controlled by the attacker. This action disconnects the legitimate administrator and redirects the site’s cloud template library to attacker‑controlled content, effectively allowing arbitrary template inclusion at the site’s discretion.

WordPress sites that have the Templately plugin installed with a version earlier than 3.7.1. The plugin’s author is listed simply as Unknown:Templately, and no specific operating systems or additional products are mentioned in the data.

The exploit does not require any privileged credentials and can be performed remotely over the web. Attackers can target the exposed request handler to overwrite the administrator connection. The EPSS score is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 indicates medium severity, and the fact that no authentication is required and the impact includes disconnection of the administrator and substitution of trusted templates indicates a high risk of abuse. The lack of an authorization check directly aligns with CWE‑862, which is known to facilitate unauthorized privilege escalation and data manipulation.