CVE-2023-5360 in the critical feed json
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
published 2023-10-31 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-57676
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 86.4%
- EPSS 86.4% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.
Patch / fix
- Unknown Royal Elementor Addons and Templates 1.3.79
Timeline
- Published
- First public exploit (Metasploit exploit/multi/http/wp_royal_elementor_addons_rce)
Exploit prediction
86.35% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/wp_royal_elementor_addons_rce WordPress Royal Elementor Addons RCE metasploit exploit, excellent rank, 2023-11-23
- EDB-52127 Royal Elementor Addons and Templates 1.3.78 - Unauthenticated Arbitrary File Upload webapps, 2025-04-05
- Nuclei template WordPress Royal Elementor Addons Plugin <= 1.3.78 - Arbitrary File Upload nuclei detection template
- wpscan.com https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Unknown Royal Elementor Addons and Templates
Classification
- Weakness
-
- CWE-434 Unrestricted Upload of File with Dangerous Type
- Technology feeds
References
-
wpscan.com
/vulnerability/281518ff-7816-4007-b712-63aed7828b34
exploit, vdb-entry, technical-description, third-party-advisory
- packetstormsecurity.com /files/175992/WordPress-Royal-Elementor-Addons-And-Templates-Remote-Shell-Upload.html
Sources
- CVE List CVE-2023-5360
- NVD CVE-2023-5360
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.