CVE-2025-13067

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor versions prior to 1.7.1049

Description The Royal Addons for Elementor plugin for WordPress has a flaw that allows arbitrary file upload. This is caused by inadequate file type validation, specifically failing to properly sanitize files named main.php. This allows authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Recommendations Update Royal Addons for Elementor to a version later than 1.7.1049.