CVE-2025-11363 Overview
CVE-2025-11363 affects the Royal Addons for Elementor WordPress plugin in versions prior to 1.7.1037. The plugin exposes the wpr_addons_upload_file AJAX action without proper authorization checks. Unauthenticated attackers can invoke this action to upload media files to the WordPress site. The flaw stems from missing authorization on a public endpoint, allowing any remote actor to abuse the upload functionality without valid credentials.
Critical Impact
Unauthenticated remote attackers can upload arbitrary media files to affected WordPress sites, consuming storage, hosting unauthorized content, or staging further attacks.
Affected Products
- Royal Addons for Elementor WordPress plugin versions before 1.7.1037
- WordPress installations with the vulnerable plugin active
- Sites exposing admin-ajax.php to unauthenticated traffic (default configuration)
Discovery Timeline
- 2025-12-15 - CVE-2025-11363 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11363
Vulnerability Analysis
The vulnerability is a Missing Authorization flaw in the file upload handler of the Royal Addons for Elementor plugin. The wpr_addons_upload_file AJAX action processes file uploads without verifying that the request originates from an authorized user. WordPress plugins typically register AJAX handlers using both wp_ajax_ and wp_ajax_nopriv_ hooks, and the latter exposes the endpoint to unauthenticated visitors. When such handlers lack capability checks or nonce validation, any remote actor can invoke them.
An attacker interacts with /wp-admin/admin-ajax.php and supplies the vulnerable action name along with the file payload. The plugin accepts the upload and writes it to the WordPress uploads directory. This allows attackers to place attacker-controlled files on the target host without authentication.
Root Cause
The root cause is Broken Access Control on the wpr_addons_upload_file handler. The function does not enforce a current_user_can() capability check and does not validate a nonce tied to an authenticated session. As a result, authorization is effectively absent for the upload endpoint.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker sends a crafted POST request to admin-ajax.php referencing the vulnerable action along with a multipart file payload. Verified technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2025-11363
Indicators of Compromise
- Unexpected files appearing under wp-content/uploads/ with recent timestamps and unfamiliar filenames
- POST requests to /wp-admin/admin-ajax.php containing the parameter action=wpr_addons_upload_file from unauthenticated sources
- Elevated volume of multipart form-data requests targeting admin-ajax.php from a single IP or ASN
Detection Strategies
- Review web server access logs for admin-ajax.php calls carrying action=wpr_addons_upload_file without an associated authenticated session cookie
- Compare the installed Royal Addons for Elementor version against 1.7.1037 using the WordPress plugin inventory
- Hash newly created files in the uploads directory and correlate against known-good baselines to surface unauthorized additions
Monitoring Recommendations
- Enable file integrity monitoring on wp-content/uploads/ and alert on file creation from web-facing PHP processes
- Aggregate WordPress and web server logs into a centralized platform for correlation across sites and time windows
- Alert on anomalous upload sizes, non-image MIME types, or filenames with executable extensions written into the uploads path
How to Mitigate CVE-2025-11363
Immediate Actions Required
- Update Royal Addons for Elementor to version 1.7.1037 or later on all affected WordPress installations
- Audit the wp-content/uploads/ directory for files created before the update and remove any unauthorized content
- Rotate any credentials or secrets that may have been exposed if unauthorized files reference sensitive data
Patch Information
The vendor addressed the missing authorization in Royal Addons for Elementor version 1.7.1037. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI. Reference the WPScan Vulnerability Report for confirmation of the fixed version.
Workarounds
- Deactivate the Royal Addons for Elementor plugin until the update to 1.7.1037 or later can be applied
- Restrict access to /wp-admin/admin-ajax.php for the wpr_addons_upload_file action at the web application firewall or reverse proxy layer
- Enforce server-side restrictions on the uploads directory to prevent execution of PHP or other server-side scripts
# Update the plugin using WP-CLI
wp plugin update royal-elementor-addons --version=1.7.1037
# Verify installed version
wp plugin get royal-elementor-addons --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
