CVE-2025-13067

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13067", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-12T13:35:40.830Z", "datePublished": "2026-03-11T04:25:47.029Z", "dateUpdated": "2026-04-08T16:48:04.452Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:04.452Z"}, "affected": [{"vendor": "wproyal", "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.7.1049", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3edfc4af-2a28-4bdf-becf-018d9f656947?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3475656/royal-elementor-addons"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "timeline": [{"time": "2025-11-12T13:51:01.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-10T15:36:21.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T15:37:38.195155Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:39:46.804Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T15:37:38.195155Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T15:39:29.689Z"}}], "cna": {"title": "Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Michael Mazzolini"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "wproyal", "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.7.1049"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-12T13:51:01.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-10T15:36:21.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3edfc4af-2a28-4bdf-becf-018d9f656947?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3475656/royal-elementor-addons"}], "descriptions": [{"lang": "en", "value": "The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:04.452Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13067", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:48:04.452Z", "dateReserved": "2025-11-12T13:35:40.830Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T04:25:47.029Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "vendor": "wproyal", "versions": [{"lessThanOrEqual": "1.7.1049", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El plugin Royal Addons for Elementor para WordPress es vulnerable a la carga arbitraria de archivos en todas las versiones hasta la 1.7.1049, inclusive. Esto se debe a una validaci\u00f3n insuficiente del tipo de archivo que detecta archivos llamados main.php, lo que permite que un archivo con dicho nombre omita la sanitizaci\u00f3n. Esto hace posible que atacantes autenticados, con acceso de nivel de autor y superior, carguen archivos arbitrarios en el servidor del sitio afectado, lo que puede hacer posible la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-13067", "lastModified": "2026-06-17T08:33:26.840", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13067", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T15:37:38.195155Z", "version": "2.0.3"}}]}, "published": "2026-03-11T05:17:46.027", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3475656/royal-elementor-addons"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3edfc4af-2a28-4bdf-becf-018d9f656947?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.7.1049]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor", "source": "cna", "vendor": "wproyal"}, "product": "royal_addons_for_elementor_\u2013_addons_and_templates_kit_for_elementor", "vendor": "wproyal"}], "analysis": {"en": {"generated_at": "2026-03-17T15:13:59.887590+00:00", "value": {"mitigation_remediation": ["Upgrade Royal Addons for Elementor to the latest release (greater than 1.7.1049).", "If an update cannot be performed immediately, remove the plugin or disable it entirely.", "Restrict author-level or higher user permissions on the site to prevent unauthorized file uploads."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All releases of the Royal Addons for Elementor \u2013 Addons and Templates Kit for Elementor up to and including version 1.7.1049 are vulnerable. The plugin is distributed by wproyal. No information indicates that versions newer than 1.7.1049 address the issue, so any deployment using a version at or below this threshold is at risk.", "description_and_impact": "The Royal Addons for Elementor plugin for WordPress allows an authenticated attacker with author-level access or higher to upload a file named main.php due to insufficient file type validation in the main.php upload handler. This arbitrary file upload vulnerability corresponds to CWE-434 (Improper Validation of File Type or Extension) and can result in remote code execution if the uploaded file contains executable PHP code. The flaw directly exposes the server\u2019s file system to unauthorized code execution, potentially compromising the entire site.", "risk_and_exploitability": "The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is reported as less than 1%, suggesting a low probability of widespread exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires valid site credentials with author-level or higher privileges, making the attack vector internal. While the impact is high for privileged accounts, the overall risk scope is limited to sites that have not patched or removed the affected plugin."}}}}, "created": "2026-03-11T11:37:58.642668+00:00", "updated": "2026-03-20T14:37:56.626267+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wproyal", "wproyal$PRODUCT$royal_addons_for_elementor_\u2013_addons_and_templates_kit_for_elementor"]}