Templaza Framework WP Registry grade F. Critical findings · 7 findingsWP RegistryCritical findings · 7 findingsOpen the reportF

Critical findings.

Audited release

1.5.6

Findings

7

Worst severity

critical

Content hash

d8bc45dd19ee65f3a11869f9… Copy

Findings

• critical Unauthenticated arbitrary file write / RCE via tz_presets save_presets (copy of attacker URL into theme dir)

  rce

  The Redux 'tz_presets' extension registers wp_ajax_templaza_framework_save_presets-<opt_name> AND its wp_ajax_nopriv_ twin in its constructor (hooks()), which runs on 'init' on every request when a templaza-framework theme is active. save_presets() performs no check_ajax_referer, nonce, or capability check. It reads $_REQUEST['preset_data']['image']['url'] and $_REQUEST['post_type'] and executes copy($image['url'], get_template_directory().'/templaza-framework/images/presets/<post_type>/<uniqid>.<img_ext>), where img_ext is taken from the basename of the attacker-supplied URL and post_type is used unsanitized in the path. An unauthenticated attacker can copy a remote PHP payload into a web-accessible directory of the active theme (full remote code execution), and the unsanitized post_type allows path traversal of the destination. It also file_put_contents() the preset JSON from request data.

  framework/extensions/tz_presets/class-redux-extension-tz-presets.php:194-275

  Recommendation

  Add check_ajax_referer() and current_user_can('edit_theme_options') (remove the wp_ajax_nopriv_ registration entirely); validate the image via the media library / wp_check_filetype_and_ext with an image allow-list instead of copying an arbitrary URL; sanitize post_type and reject any extension that is not a known image type.

• high Unauthenticated arbitrary file deletion via tz_presets remove_presets path traversal

  file_access

  remove_presets() is registered on wp_ajax_ and wp_ajax_nopriv_ with no nonce or capability check. It builds $file = get_preset_path().'/'.$_REQUEST['name'].'.json' with 'name' unsanitized and calls unlink($file), allowing path traversal to delete arbitrary .json files (e.g. configuration/cache files). It then reads the target preset's JSON and unlink()s a second path built from its 'image' value, extending the deletion primitive.

  framework/extensions/tz_presets/class-redux-extension-tz-presets.php:158-192

  Recommendation

  Require check_ajax_referer() + current_user_can('edit_theme_options'), drop the nopriv hook, and sanitize_file_name()/basename() the name and reject any value containing path separators.

• high Unauthenticated preset load overwrites theme option files / reads arbitrary JSON

  missing_auth

  load_presets() is registered on wp_ajax_ and wp_ajax_nopriv_ with no nonce or capability check. It reads a preset file from get_preset_path().'/'.$_REQUEST['name'].'.json' (name unsanitized -> can read arbitrary .json via traversal) and file_put_contents() its decoded 'preset' value into an existing theme options JSON file selected by $_REQUEST post_type/post_id/page. An unauthenticated attacker can overwrite persisted theme option files with attacker-chosen content, corrupting or tampering with site configuration.

  framework/extensions/tz_presets/class-redux-extension-tz-presets.php:107-157

  Recommendation

  Require check_ajax_referer() + current_user_can('edit_theme_options'), remove the nopriv hook, and basename()/allow-list the preset name and destination.

• high Unauthenticated write of global_colors.json (ajax_save_global_colors)

  missing_auth

  wp_ajax_nopriv_tzfrm_global_colors_ajax_save -> ajax_save_global_colors() has an explicit phpcs NonceVerification disable and no capability check. It parses $_POST['data'] and file_put_contents() the result to uploads/templaza/theme/<theme>/options/global_colors/global_colors.json. That file is read by Functions::get_global_colors()/get_global_color_by_id() and the resolved colors are emitted into front-end inline CSS (includes/css.php, wp_add_inline_style). An unauthenticated attacker can persist arbitrary global-color configuration that is served to every visitor and injected into site CSS.

  framework/framework.php:345-373

  Recommendation

  Add check_ajax_referer() and current_user_can('edit_theme_options'), remove the wp_ajax_nopriv_ registration, and strictly validate/escape color values before they reach inline CSS.

• medium Unauthenticated license-option overwrite and outbound request (save_license_from_templaza)

  missing_auth

  wp_ajax_nopriv_save_license_from_templaza -> save_license_from_templaza() has no nonce or capability check. It takes $_POST['license_key'], sends a server-side wp_remote_post to templaza.com, and on a 'success' response calls update_option() on the theme license option. An unauthenticated attacker can overwrite the stored license option and force repeated outbound activation requests.

  framework/framework.php:547-595

  Recommendation

  Require check_ajax_referer() + current_user_can('edit_theme_options') and remove the nopriv hook.

• medium Logged-in user can create templaza_library posts/meta with no nonce or capability check

  missing_capability

  wp_ajax_templaza-framework/field/tz_layout/action/save_section -> save_field_section() (registered only as wp_ajax_, so any authenticated user) performs no check_ajax_referer and no capability check. It wp_insert_post/wp_update_post a published templaza_library post from $_REQUEST['title'] and stores $_REQUEST['section'] and update_post_meta '_templaza_library_type', letting a Subscriber create/overwrite reusable library sections.

  framework/post-types/templaza_library.php:134-175

  Recommendation

  Add check_ajax_referer() and current_user_can('edit_theme_options') (or an appropriate edit capability) before creating posts/meta.

• low Unauthenticated support-email trigger (templaza_send_support_email)

  missing_auth

  wp_ajax_nopriv_templaza_send_support_email -> templaza_send_support_email() has no nonce or capability check and sends a wp_mail to the fixed address support@templaza.com (with the current user's email as Cc, empty for anonymous). The recipient is fixed and content is sanitized, so impact is limited to unauthenticated email-send abuse / spam toward the vendor.

  framework/framework.php:496-541

  Recommendation

  Add check_ajax_referer() + current_user_can('edit_theme_options') and remove the nopriv hook.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.