CVE-2026-15359

Descripción

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator-s stored cloud service connection with an account under their control, disconnecting the legitimate administrator and redirecting the site-s cloud template library to attacker-controlled content.