CVE-2025-13067 - Vulnerability Analysis

Overview

Royal Addons for Elementor WordPress plugin <= 1.7.1049 contains an unrestricted file upload vulnerability caused by insufficient file type validation allowing main.php files to bypass sanitization, letting authenticated authors upload arbitrary files potentially leading to remote code execution.

Severity & Score

Impact

Authenticated authors can upload arbitrary files, potentially leading to remote code execution and full server compromise.

Mitigation

Update to the latest version beyond 1.7.1049.

References

• https://plugins.trac.wordpress.org/changeset/3475656/royal-elementor-addons
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3edfc4af-2a28-4bdf-becf-018d9f656947?source=cve

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 11, 2026

🟠 CVE-2025-13067 - High (8.8) The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-13067/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner