CVE-2025-11363

Vulnerability

Overview

The Royal Addons for Elementor WordPress plugin, versions prior to 1.7.1037, fails to properly enforce authorization checks on the wpr_addons_upload_file action. This missing capability or nonce verification allows any unauthenticated user to trigger the file upload functionality without needing any privileges or authentication [1].

Exploitation requires no special conditions beyond network access to a WordPress site running the vulnerable plugin. The attacker can send a crafted request to the upload endpoint, bypassing intended access controls [1].

Impact

Successful exploitation enables an unauthenticated attacker to upload arbitrary media files to the WordPress media library. While the uploaded files are limited to media types (images, videos, documents, etc.), this can still be abused to fill the server's storage, potentially leading to denial of service, or to upload files that may be used in further attacks (e.g., hosting malicious content) [1].

Mitigation

The vulnerability has been fixed in version 1.7.1037 of the plugin. Users are strongly advised to update immediately. No workarounds are documented; the only remediation is applying the patch [1].