CVE-2025-11363
BaseFortify
Publication date: 2025-12-15
Last updated on: 2025-12-15
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| royal_addons | elementor_wordpress_plugin | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Royal Elementor Addons and Templates WordPress plugin versions before 1.7.1037. It is caused by improper authorization, which allows unauthenticated users to upload media files via the 'wpr_addons_upload_file' AJAX action. An attacker can exploit this by obtaining a nonce value from the site's JavaScript configuration and then sending a crafted POST request to upload arbitrary files to the server without needing to log in. [1]
How can this vulnerability impact me? :
The vulnerability allows unauthenticated attackers to upload arbitrary files to the server, which can lead to unauthorized file uploads. This can result in malicious files being hosted on the website, potentially enabling further attacks such as remote code execution, defacement, or distribution of malware. It compromises the security and integrity of the affected website. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by attempting to upload a file via the vulnerable AJAX action without authentication. First, retrieve the nonce value `wpr_addons_nonce` from the JavaScript object `WprConfig` in the browser console. Then, use a curl command to POST a file upload request to `http://example.com/wp-admin/admin-ajax.php` with form data including `action=wpr_addons_upload_file`, `triggering_event=click`, the retrieved nonce, and the file to upload. If the file uploads successfully and is accessible under `/wp-content/uploads/wpr-addons/forms`, the system is vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Royal Elementor Addons and Templates WordPress plugin to version 1.7.1037 or later, where the issue has been fixed. [1]