Home

Description

The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.

PUBLISHED Reserved 2025-10-06 | Published 2025-12-15 | Updated 2025-12-15 | Assigner WPScan

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status
unaffected

Any version before 1.7.1037
affected

Credits

Envel Le Clainche finder

WPScan coordinator

References

wpscan.com/...rability/b2eadb7a-30a4-44c7-a420-849484faccf4/ exploit vdb-entry technical-description

cve.org (CVE-2025-11363)

nvd.nist.gov (CVE-2025-11363)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.