How to fix CVE-2025-13067?

Within 24 hours: Identify all WordPress instances using Royal Addons for Elementor and document affected versions. Within 7 days: Disable the plugin on all production sites until a patch is released, or restrict plugin access to authenticated administrative users only. Within 30 days: Monitor vendor communications for patch availability and establish a validation process before re-enabling the plugin.

Is PHP affected by CVE-2025-13067?

Royal Addons for Elementor plugin contains a critical file upload vulnerability affecting WordPress sites running version 1.7.1049 or earlier. Attackers could upload malicious files to compromise website integrity, deface content, or establish persistence.

CVE-2025-13067

HIGH

2026-03-11 [email protected]

8.8

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 05:17 nvd

HIGH 8.8

Description

The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Analysis

Royal Addons for Elementor (WordPress plugin) versions up to 1.7.1049. is affected by unrestricted upload of file with dangerous type (CVSS 8.8).

Technical Context

This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects Royal Addons for Elementor (WordPress plugin). The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected Products

Vendor: WordPress. Product: Royal Addons for Elementor (WordPress plugin). Versions: up to 1.7.1049..

Remediation

Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +44

POC: 0

CVE-2025-13067 vulnerability details – vuln.today

Back

CVE-2025-13067

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

CVE-2025-13067

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Technical Context

Affected Products

Remediation

Priority Score

Share

External POC / Exploit Code