CVE-2026-13405 Overview
CVE-2026-13405 affects the Royal Addons for Elementor WordPress plugin in versions before 1.7.1066. The plugin fails to sanitize custom widget markup before writing it to a PHP file that is later executed. Users with the manage_options capability can inject arbitrary PHP code that runs in the WordPress process. On WordPress Multisite deployments, subsite administrators who do not otherwise hold code-execution capabilities can also exploit the flaw. The issue is classified as Improper Control of Generation of Code [CWE-94].
Critical Impact
Authenticated administrators can execute arbitrary PHP code on the underlying server, breaking the Multisite privilege boundary between super administrators and subsite administrators.
Affected Products
- Royal Addons for Elementor WordPress plugin versions before 1.7.1066
- WordPress single-site installations where the plugin is active
- WordPress Multisite installations where subsite administrators can access the plugin
Discovery Timeline
- 2026-08-20 - CVE-2026-13405 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-13405
Vulnerability Analysis
The Royal Addons for Elementor plugin persists custom widget markup by writing it to a PHP file on disk. That file is subsequently included and executed as part of normal plugin operation. Because the widget markup is not correctly sanitized before being written, an authenticated user can embed PHP tags and arbitrary statements into the stored template. The next request that loads the generated file causes the PHP interpreter to execute the attacker-controlled code.
The flaw is a code injection issue rather than a template escaping problem. The stored payload becomes executable code, not rendered output. This mirrors the classic pattern captured by [CWE-94] where untrusted input flows into a code generation step.
Root Cause
The plugin treats widget markup as static content and does not strip or escape PHP delimiters, backticks, or other syntactic elements before serializing the markup into a .php file. The trust boundary is drawn at the WordPress capability check for manage_options, but the code-writing routine is reachable by roles that WordPress does not otherwise consider capable of executing arbitrary code. On Multisite, this incorrectly elevates subsite administrators to effective super-administrator privileges.
Attack Vector
An authenticated attacker with access to the widget editor submits a widget definition containing PHP code. The plugin writes the payload into its cached widget file. When WordPress next renders a page that references the widget, the file is included and the injected PHP executes with the privileges of the web server user. See the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-13405
Indicators of Compromise
- New or recently modified .php files inside the Royal Addons for Elementor cache or widget directories under wp-content/
- PHP files under plugin-managed paths containing shell functions such as system, exec, passthru, eval, or base64_decode
- Outbound network connections initiated by the PHP-FPM or web server worker shortly after a widget save operation
- WordPress audit log entries showing widget updates from subsite administrator accounts on Multisite installations
Detection Strategies
- Monitor file integrity on the plugin cache directory and alert on writes that contain PHP open tags in template files
- Correlate WordPress edit_post or widget-save actions with immediate PHP file creation on disk
- Inspect web server access logs for administrator sessions followed by requests to pages that render Royal Addons widgets
Monitoring Recommendations
- Enable WordPress audit logging for plugin, widget, and option changes on all sites
- Restrict outbound network access from PHP workers so that injected code cannot easily reach command-and-control infrastructure
- Review the list of accounts holding manage_options on both single-site and Multisite installations and remove accounts that do not require it
How to Mitigate CVE-2026-13405
Immediate Actions Required
- Update the Royal Addons for Elementor plugin to version 1.7.1066 or later on every site in the network
- Audit administrator and subsite administrator accounts and rotate credentials for any account that may have been used to modify widgets
- Scan the plugin's generated PHP files for unexpected code and remove any files that contain untrusted content
Patch Information
The vendor fixed the issue in Royal Addons for Elementor version 1.7.1066. Administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for the authoritative advisory.
Workarounds
- Deactivate the Royal Addons for Elementor plugin until the patched version can be deployed
- On Multisite, limit the plugin to network activation controlled by super administrators and restrict subsite administrators from managing plugin widgets
- Set the PHP disable_functions directive to block high-risk functions such as exec, system, and passthru where the application does not require them
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
