WordPress sites using Templately should plan a supported update to version 3.7.2. The CVE record for CVE-2026-18438 identifies Templately releases through 3.7.1 as affected, and the official project changelog identifies 3.7.2 as the security-fix release. Use the normal maintenance process, then verify that the site’s templates, roles, and important visitor journeys still work as intended.

This checklist is for site owners, store managers, agencies, and WordPress administrators. It does not replace a site’s approved maintenance, recovery, or access-control process.

Confirm whether your site needs the update

Open the Plugins screen on a site you manage and identify Templately. The CVE record lists releases through 3.7.1 as affected. The project’s official changelog identifies 3.7.2 as the security-fix release.

• Record the installed version, site owner, and normal maintenance window before making a change.
• Confirm that the plugin is Templately rather than a similarly named template or builder tool.
• Identify the person responsible for site design, ecommerce, memberships, and customer support so validation has clear ownership.
• Keep your existing recovery process available. This security update does not call for a full-account archive, a database export, or a customer backup-schedule change.

Use the supported update path

1. Review pending WordPress changes so unrelated maintenance is not mixed into this security update.
2. Update Templately to version 3.7.2 through a trusted, owner-approved source. Do not sideload a package from an unverified site.
3. If your trusted update screen has not yet made 3.7.2 available, pause the update claim and coordinate with the plugin vendor or your managed WordPress provider. Do not treat an older directory listing as evidence that 3.7.1 is fixed.
4. After the update finishes, confirm the installed version on the Plugins screen and note the result in the normal maintenance record.

Use the Fix I.T. Phill WordPress update guide when a plugin update needs broader planning or a compatibility review.

Verify template and site behavior

Keep the release check proportional to the site’s use of templates. Start with the paths that matter to visitors and customers rather than making unrelated changes.

• Open a representative public page that uses the site’s normal template and confirm it renders as expected.
• Check a planned editor workflow with an authorized account, including saving an ordinary approved change without publishing unnecessary live content.
• For stores, memberships, or lead-generation sites, review the normal account, form, and checkout journey without creating avoidable live transactions.
• Use only approved template sources while the maintenance window is open, and defer nonessential template changes until the update check is complete.
• Confirm the site cache or CDN serves the expected public page after the maintenance owner completes their normal cache process.

Review access and unexpected changes

A security update is a sensible time for ordinary access review. This is not a reason to make broad, unplanned configuration changes.

• Review WordPress roles and remove access that is no longer needed.
• Check recent template, global-style, and key-page changes for work the team cannot explain.
• Use the normal incident-review process to review administrator activity and server records only when there is a concrete concern.
• Escalate unexplained changes to the site owner or support provider before attempting cleanup on a customer site.

Keep the communication clear

A short maintenance note is usually enough: the plugin was updated to the supported security release, key template and visitor paths were checked, and any compatibility follow-up has an owner. For broader maintenance help, visit the Fix I.T. Phill WordPress Support hub.

Templately CVE-2026-18438 FAQ

Which Templately versions are affected?

The CVE record lists Templately releases through 3.7.1 as affected. The official project changelog identifies 3.7.2 as the security-fix release. Verify the actual package version from the trusted source you use for the site.

What if my WordPress dashboard does not offer 3.7.2 yet?

Do not source a package from an unverified location. Coordinate with the plugin vendor, your managed WordPress provider, or the site owner until the trusted supported release is available, then use the normal maintenance workflow.

What should I check first after updating?

Confirm the installed version, a representative public template, an approved editor workflow, the site’s important visitor journeys, and the administrator access list. Escalate unexpected changes through the normal support or incident process.