CVE-2026-57658: WordPress TemplateSpare plugin <= 4.2.0 - Arbitrary File Upload vulnerability

Synopsis

An arbitrary file upload vulnerability exists in the TemplateSpare WordPress plugin at version 4.2.0 and earlier. An authenticated attacker with administrator-level access can reach the vulnerable endpoint over the network and upload arbitrary files to the server, including executable code. Successful exploitation gives the attacker the ability to read, modify, or destroy data on the host and execute arbitrary code in the scope of the web server process. No patched version has been published; HarborGuard is tracking the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  An administrator-level account is required; a low-privilege account is not sufficient to trigger the upload endpoint.

• Victim interactionNot required

  No victim interaction is needed; the attacker can carry out the upload entirely without involving another user.

• Attack complexityDetail

  Exploit complexity is low, meaning no race conditions or special environmental factors are required and the attack is reliably reproducible.

Blast Radius

• The attacker can upload and execute arbitrary server-side code, achieving remote code execution in the context of the web server process.
• Confidential data stored by the WordPress installation, including database credentials, session tokens, and user records, is fully readable by the attacker.
• The attacker can modify or delete persisted content, configuration files, and database rows, corrupting site integrity.
• The attacker can crash or render unavailable the web application and any services sharing the same host resources.