CVE-2023-5360 Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload

What is CVE-2023-5360?

CVE-2023-5360 is a critical vulnerability in Royal-Elementor-Addons Royal Elementor Addons, published on 31 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.

Weakness: CWE-434

Which versions are affected by CVE-2023-5360?

It affects 1 product.

Products include Royal-Elementor-Addons Royal Elementor Addons.

How do I fix CVE-2023-5360?

No fix has been published for CVE-2023-5360 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-5360 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5360 exists.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 8 proofs of concept on GitHub.

Other vulnerabilities in Royal-Elementor-Addons Royal Elementor Addons

• CVE-2024-1567 Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload High 8.2
• CVE-2023-5922 Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read High 7.5
• CVE-2024-56226 WordPress Royal Elementor Addons plugin <= 1.7.1001 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2025-39361 WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-56062 WordPress Royal Elementor Addons and Templates plugin <= 1.3.987 - Cross Site Scripting (XSS) vulnerability Medium 6.5

All Royal-Elementor-Addons Royal Elementor Addons vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2rrm-7h4w-qg5g.