CVE-2025-13067: 
WordPress vulnerability analysis and mitigation

CVE-2025-13067 is an arbitrary file upload vulnerability in the Royal Addons for Elementor plugin for WordPress, affecting all versions up to and including 1.7.1049. The flaw allows authenticated attackers with author-level access or higher to upload arbitrary files — including PHP scripts — to the server, potentially enabling remote code execution. It was published on March 11, 2026, and assigned a CVSS v3.1 base score of 8.8 (High) (Wordfence, ENISA EUVD).

The root cause is insufficient file type validation (CWE-434: Unrestricted Upload of File with Dangerous Type). Specifically, the plugin's sanitization logic fails to properly detect or block files named main.php, allowing such filenames to bypass the file type check entirely. An authenticated attacker with at least author-level WordPress privileges can exploit this by uploading a maliciously crafted PHP file named main.php through the plugin's upload functionality, which is then stored on the server in an accessible location. A patch commit addressing this issue is available in the WordPress plugin repository (WordPress Trac, Wordfence).

Successful exploitation allows an attacker to upload and potentially execute arbitrary PHP code on the affected WordPress server, resulting in full confidentiality, integrity, and availability compromise. An attacker could exfiltrate sensitive data (database credentials, user data), deface or modify site content, install persistent backdoors, and use the compromised server as a pivot point for lateral movement within the hosting environment (Wordfence, ENISA EUVD).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.099%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the author level or above, which limits the attack surface compared to unauthenticated vulnerabilities. The vulnerability has been detected by Qualys (detection ID 531084) (Qualys).

1. Reconnaissance: Identify WordPress sites running the Royal Addons for Elementor plugin (version ≤ 1.7.1049) using tools like WPScan, Shodan, or by inspecting plugin metadata in page source.
2. Obtain authenticated access: Acquire or compromise a WordPress account with at least author-level privileges (e.g., via credential stuffing, phishing, or registering if open registration is enabled).
3. Craft malicious file: Create a PHP web shell or reverse shell payload and save it with the filename main.php to exploit the validation bypass.
4. Upload via plugin functionality: Use the Royal Addons for Elementor plugin's file upload feature to upload the main.php file. The plugin's sanitization fails to block this filename, allowing the upload to succeed.
5. Locate uploaded file: Determine the upload directory path (typically within wp-content/uploads/ or a plugin-specific subdirectory) by reviewing server responses or common WordPress upload paths.
6. Execute payload: Access the uploaded main.php file via its web-accessible URL to trigger remote code execution, establishing a shell or performing further malicious actions on the server (Wordfence, WordPress Trac).

• File System: Presence of main.php in WordPress upload directories (e.g., wp-content/uploads/ or plugin-specific subdirectories); unexpected PHP files in directories that should only contain media uploads; newly created or modified PHP files owned by the web server user.
• Network: HTTP GET or POST requests to wp-content/uploads/*/main.php or similar paths in web server access logs; outbound connections from the web server process to unknown external IPs (indicative of reverse shell activity).
• Logs: WordPress audit logs showing file uploads by author-level users, particularly files named main.php; web server access logs showing requests to PHP files within upload directories returning 200 OK responses.
• Process: Unusual child processes spawned by the web server (e.g., php, /bin/bash, curl, wget) not associated with normal WordPress operations.

Update the Royal Addons for Elementor plugin to a version beyond 1.7.1049 that includes the fix introduced in changeset 3475656 (WordPress Trac). If an immediate update is not possible, disable or uninstall the plugin and restrict file upload capabilities to only highly trusted users. Implement server-level controls to prevent PHP execution within WordPress upload directories (e.g., via .htaccess rules or web server configuration). Deploy a Web Application Firewall (WAF) with rules to block suspicious PHP file uploads. Audit all author-level and above WordPress accounts to ensure no unauthorized accounts exist (Wordfence).

Wordfence, which discovered and reported the vulnerability, included it in their weekly WordPress vulnerability report for March 9–15, 2026 (Wordfence Blog). Sucuri also referenced the vulnerability in their March 2026 vulnerability patch roundup (Sucuri Blog). No significant broader social media discussion or notable researcher commentary beyond standard vulnerability tracking has been observed.