High severity · published Mar 11, 2026
CVE-2025-13067
Royal Addons for Elementor <= 1.7.1049 - Authenticated (Author+) Arbitrary File Upload via main.php Upload Bypass
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Royal Addons for Elementor – Addons and Templates Kit for Elementor · wproyal
through 1.7.1049 · source: vendor
Affected product
RA
Royal Addons for Elementor – Addons and Templates Kit for Elementor
wproyal
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13067
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13067
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3475656/royal-elementor-addons
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/3edfc4af-2a28-4bdf-becf-018d9f656947?source=cve
More from Royal Addons for Elementor – Addons and Templates Kit for Elementor
8.8
CVE-2026-17123
Royal Addons for Elementor <= 1.7.1064 - Authenticated (Contributor+) Server-Side Request Forgery via Form Builder Widget 'webhook_url' Setting
8.8
CVE-2025-1441
Royal Elementor Addons and Templates <= 1.7.1007 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
7.2
CVE-2026-4803
Royal Addons for Elementor <= 1.7.1056 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter in wpr_update_form_action_meta
7.2
CVE-2026-6229
Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter
6.5
CVE-2026-8118
Royal Addons for Elementor – Addons and Templates Kit for Elementor 1.7.1058 - 1.7.1059 - Authenticated (Contributor+) Arbitrary File Read via Data Table Widget CSV File Source