The vulnerability allows an authenticated attacker with contributor-level access to upload a file that bypasses WordPress’ file type validation by exploiting a mismatch between the filename used for validation and the destination filename. A GIF+PHP polyglot file is accepted as an image/gif based on the Content-Disposition header while the file is actually written with a .php extension derived from the URL path. This allows execution of arbitrary PHP code on the server, effectively granting remote code execution. The weakness is a classic file upload validation flaw (CWE-434).

WordPress sites running the Templately – Elementor & Gutenberg Template Library plugin ver. 3.7.1 or earlier (up to and including version 3.7.1) are affected. The plugin is authored by wpdevteam. No higher versions are listed as affected in this data.

The CVSS score of 8.8 reflects a high severity with potential compromise of confidentiality, integrity, and availability. The EPSS score of < 1% indicates that, at the time of analysis, the likelihood of exploitation is low, though not zero. The vulnerability is not yet listed in CISA KEV. The attack vector relies on REST API endpoints that are protected only by delete_posts capability checks, so any user with contributor privileges can exploit it. The attacker must be authenticated and has sufficient permissions to use the cloud import functions exposed by the plugin.