CVE-2025-13067 - CVE House
Back to Database
Status published High CVE-2025-13067

Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass

Vulnerability Description

The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-13067

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Michael Mazzolini

References

More from wproyal

View All →
CVE-2025-6251
Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2025-63018
WordPress Bard theme <= 2.229 - Broken Access Control vulnerability
Medium 4.3
CVE-2025-5338
Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets
Medium 6.4
CVE-2025-3813
Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium 6.4
CVE-2025-24766
WordPress News Magazine X <= 1.2.35 - Local File Inclusion Vulnerability
High 7.5

Affected Vendor

Affected Software

Royal Addons for Elementor – Addons and Templates Kit for Elementor
Vulnerable Versions:
0

Timeline

Official Publish: March 11th, 2026
Last Modified: April 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact