CVE-2025-13067: Royal Addons for Elementor RCE Vulnerability

CVE-2025-13067 Overview

The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This vulnerability stems from insufficient file type validation when detecting files named main.php, allowing a file with such a name to bypass sanitization mechanisms. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Critical Impact

Attackers with author-level access can upload malicious PHP files to WordPress servers, potentially achieving full remote code execution and complete site compromise.

Affected Products

• Royal Addons for Elementor plugin for WordPress versions up to and including 1.7.1049
• WordPress sites running vulnerable Royal Addons for Elementor installations
• WordPress multisite deployments with the affected plugin enabled

Discovery Timeline

• 2026-03-11 - CVE-2025-13067 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-13067

Vulnerability Analysis

This arbitrary file upload vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) exists within the Royal Addons for Elementor plugin's file handling functionality. The core issue lies in the plugin's insufficient file type validation mechanism, which fails to properly detect and block files specifically named main.php.

When processing file uploads, the plugin implements sanitization routines designed to prevent malicious file uploads. However, the validation logic contains a flaw that allows files with the filename main.php to bypass these security controls. This bypass enables authenticated users with author-level privileges or higher to upload arbitrary PHP files to the server.

The impact of successful exploitation is severe. An attacker who uploads a malicious PHP file gains the ability to execute arbitrary code within the context of the web server. This can lead to complete site takeover, data theft, malware injection, defacement, and use of the compromised server as part of larger attack infrastructure.

Root Cause

The vulnerability originates from a logic error in the file type validation routine. The plugin's sanitization mechanism appears to have an exception or oversight that fails to properly classify files named main.php as potentially dangerous. Rather than implementing a robust allow-list approach for permitted file types, the validation logic relies on pattern matching that can be circumvented with this specific filename.

Attack Vector

The attack requires network access and authenticated access to the WordPress site with at least author-level privileges. The attacker must:

1. Authenticate to the WordPress site with author or higher privileges
2. Navigate to a functionality within the Royal Addons for Elementor plugin that processes file uploads
3. Craft a malicious PHP file renamed to main.php containing arbitrary code
4. Upload the malicious file, bypassing the sanitization checks
5. Access the uploaded file via its web-accessible URL to trigger code execution

This vulnerability does not require any user interaction beyond the attacker's actions, and successful exploitation results in full confidentiality, integrity, and availability impact to the affected system.

Detection Methods for CVE-2025-13067

Indicators of Compromise

• Unexpected main.php files appearing in WordPress upload directories or plugin folders
• Suspicious PHP files in /wp-content/uploads/ directories with recent modification timestamps
• Web server logs showing unusual POST requests to Royal Addons for Elementor endpoints followed by requests to newly created PHP files
• Anomalous outbound network connections originating from the web server process

Detection Strategies

• Monitor file system changes in WordPress upload directories for new PHP file creation
• Implement web application firewall (WAF) rules to inspect file upload requests for PHP content regardless of filename
• Review WordPress user accounts with author-level or higher privileges for unauthorized access
• Audit access logs for patterns consistent with webshell deployment and usage

Monitoring Recommendations

• Enable file integrity monitoring (FIM) on all WordPress directories, particularly /wp-content/
• Configure alerting for any new PHP file creation in upload directories
• Monitor for process execution anomalies from the web server user account
• Implement network traffic analysis to detect command and control communications

How to Mitigate CVE-2025-13067

Immediate Actions Required

• Update Royal Addons for Elementor plugin to a version newer than 1.7.1049 immediately
• Audit existing WordPress upload directories for any suspicious main.php files
• Review all user accounts with author-level access or higher for unauthorized accounts
• Consider temporarily disabling the Royal Addons for Elementor plugin until patching is confirmed
• Scan the server for indicators of prior compromise, including webshells and backdoors

Patch Information

A security patch has been released by the plugin developers. The fix can be verified through the WordPress Plugin Changeset. Site administrators should update to the latest available version through the WordPress plugin update mechanism or by manually downloading from the WordPress plugin repository.

For additional vulnerability details and guidance, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict user registration and carefully audit accounts with author-level or higher privileges
• Implement server-level controls to prevent PHP execution in upload directories using .htaccess rules or web server configuration
• Deploy a web application firewall (WAF) with rules to block malicious file uploads
• Consider using file upload scanning solutions that analyze file content rather than relying solely on filename validation

# Apache .htaccess configuration to prevent PHP execution in uploads
# Place this file in /wp-content/uploads/.htaccess
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>

# For Nginx, add to server block:
# location ~* /wp-content/uploads/.*\.php$ {
#     deny all;
# }