CVE-2023-5360

🗓️ 31 Oct 2023 13:54:42Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 333 Views🌐 WEB

The Royal Elementor Addons WordPress plugin before 1.3.79 allows unauthenticated users to upload arbitrary files

Reporter	Title	Published	Views	Family All 36
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons	14 Jul 202518:09	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons	27 Dec 202513:27	–	githubexploit
GithubExploit	Mephisto	21 May 202605:06	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons	5 Nov 202318:02	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons	2 Nov 202303:15	–	githubexploit
GithubExploit	Exploit for Unrestricted Upload of File with Dangerous Type in Royal-Elementor-Addons Royal_Elementor_Addons	3 Nov 202300:58	–	githubexploit
GithubExploit	Exploit for CVE-2023-4666	14 Oct 202314:04	–	githubexploit
0day.today	WordPress Royal Elementor 1.3.78 Shell Upload Vulnerability	16 Oct 202300:00	–	zdt
0day.today	WordPress Royal Elementor Addons Remote Code Execution Exploit	28 Nov 202300:00	–	zdt
ATTACKERKB	CVE-2023-5360	31 Oct 202300:00	–	attackerkb

NVD

Vulners

Node

royal-elementor-addons royal_elementor_addonsRange<1.3.79wordpress

[
  {
    "vendor": "Unknown",
    "product": "Royal Elementor Addons and Templates",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "1.3.79"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34
packetstormsecurity	www.packetstormsecurity.com/files/175992/WordPress-Royal-Elementor-Addons-And-Templates-Remote-Shell-Upload.html

Parameter	Position	Path	Description	CWE
wpr_addons_nonce	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via Elementor Royal Addons plugin vulnerability enabling arbitrary file upload (including PHP) leading to RCE.	CWE-434
max_file_size	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via Elementor Royal Addons plugin vulnerability enabling arbitrary file upload (including PHP) leading to RCE.	CWE-434
allowed_file_types	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via Elementor Royal Addons plugin vulnerability enabling arbitrary file upload (including PHP) leading to RCE.	CWE-434
action	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via Elementor Royal Addons plugin vulnerability enabling arbitrary file upload (including PHP) leading to RCE.	CWE-434
triggering_event	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via Elementor Royal Addons plugin vulnerability enabling arbitrary file upload (including PHP) leading to RCE.	CWE-434
uploaded_file	request body	/wp-admin/admin-ajax.php	Unauthenticated file upload via Elementor Royal Addons plugin vulnerability enabling arbitrary file upload (including PHP) leading to RCE.	CWE-434

17 Jun 2026 06:48Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.81695