CVE-2023-5360

What it actually does

Royal Elementor Addons and Templates for WordPress versions before 1.3.79 fail to properly validate uploaded files. An unauthenticated remote attacker can abuse the plugin’s upload functionality to place arbitrary files on the web server, including PHP web shells. If the uploaded file is stored in a web-accessible location and executed by the PHP runtime, the attacker gains remote code execution in the context of the web server/PHP process, enabling command execution, file modification, credential theft from WordPress configuration files, plugin/theme tampering, and persistence.

Why it matters to the business

Successful exploitation can give an attacker full control of an affected WordPress site, allowing website defacement, malware or skimmer injection, data theft, spam/SEO abuse, redirect campaigns, and disruption of customer-facing services. The flaw is critical, remotely exploitable without authentication, and has weaponized exploit activity with a high EPSS score, so internet-facing sites running vulnerable versions should be treated as high-priority exposure even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker scans the internet for WordPress sites using the Royal Elementor Addons and Templates plugin. They identify a vulnerable version prior to 1.3.79, then send a crafted unauthenticated upload request to the plugin’s vulnerable upload handler. Because the plugin does not sufficiently validate file type, extension, MIME type, or executable content, the attacker uploads a PHP payload disguised or delivered as an accepted upload. After determining the stored file path, the attacker requests the uploaded PHP file directly through the web server. The PHP code executes under the web server user, giving the attacker command execution or a web shell. From there, they may enumerate the WordPress installation, read wp-config.php for database credentials, create administrator users, modify themes/plugins for persistence, inject malicious JavaScript, stage additional malware, or pivot further within the hosting environment depending on permissions.

How to fix it

Upgrade Royal Elementor Addons and Templates to version 1.3.79 or later immediately. If an exact fixed package version is not available through automated dependency management, update from the official WordPress plugin repository or vendor distribution channel and verify the installed plugin reports at least 1.3.79. If immediate upgrade is not possible, disable and remove the plugin until it can be safely updated. Restrict direct execution of PHP in upload directories, enforce server-side file extension and MIME validation, block unauthenticated access to plugin upload endpoints where feasible, and apply web application firewall rules for suspicious multipart upload requests targeting the plugin. Review filesystem permissions so the web server cannot write executable code into web-accessible directories where possible. After patching, remove any unknown uploaded PHP files, modified plugin/theme files, and unauthorized WordPress administrator accounts.

How to confirm the fix worked

Confirm the installed Royal Elementor Addons and Templates plugin version is 1.3.79 or later from the WordPress admin plugin page, WP-CLI, or filesystem plugin metadata. Validate that unauthenticated upload attempts to the previously vulnerable functionality are rejected and that uploaded files cannot be executed as PHP. Check web server configuration to ensure PHP execution is disabled in wp-content/uploads and other writable upload paths. Run file integrity checks against WordPress core, themes, and plugins, and compare plugin files to clean vendor copies. Search for unexpected PHP files in upload directories and recently modified files around the suspected exposure window. Confirm no unauthorized WordPress users, scheduled tasks, cron jobs, or persistent web shells remain.

Typical attack path

1. Identify WordPress sites with the Royal Elementor Addons and Templates plugin installed.
2. Fingerprint the plugin version or test for vulnerable upload behavior affecting versions before 1.3.79.
3. Send a crafted unauthenticated file upload request containing a PHP payload or web shell.
4. Locate the uploaded file in a web-accessible uploads/plugin directory.
5. Request the uploaded PHP file over HTTP to execute attacker-controlled code.
6. Use the web shell to run commands, read WordPress configuration, modify site files, or create persistence.
7. Deploy follow-on payloads such as backdoors, redirect scripts, spam tooling, credential stealers, or defacement content.

How to detect it

Review HTTP access logs, WAF logs, CDN logs, WordPress logs, endpoint telemetry, and file modification records for evidence of unauthenticated file uploads followed by execution of uploaded PHP files. Focus on requests to WordPress plugin paths associated with Royal Elementor Addons and Templates, multipart/form-data POST requests from unknown clients, unusual 200 responses for uploaded .php files, and requests containing command-execution parameters. Search the web root for recently created or modified PHP files in wp-content/uploads, cache, temporary, plugin, and theme directories. Examine web shell indicators such as use of eval, base64_decode, gzinflate, shell_exec, system, passthru, proc_open, assert, or preg_replace with executable code patterns. Review WordPress users for unexpected administrator accounts, database records for injected site URLs or scripts, and scheduled jobs/cron entries for persistence. If endpoint logging is available, look for the web server process spawning shells or system utilities such as sh, bash, cmd, powershell, curl, wget, perl, python, or php with unusual arguments. Because exploitation is weaponized, include retrospective searches from the publication date onward and especially around any spikes in POST requests or file modifications.

• /wp-content/plugins/royal-elementor-addons/
• royal-elementor-addons
• multipart/form-data
• POST /wp-admin/admin-ajax.php
• /wp-content/uploads/royal-elementor-addons/
• /wp-content/uploads/*.php
• /wp-content/uploads/*/*.php
• /wp-content/uploads/*/*/*.php
• eval(
• base64_decode(
• gzinflate(
• shell_exec(
• passthru(
• system($_
• proc_open(
• assert($_
• preg_replace('/.*/e'
• FilesMan
• WSOsetcookie
• c99shell
• r57shell
• b374k
• cmd=
• exec=
• command=
• /bin/sh
• /bin/bash
• wget
• curl
• wp-config.php

What your security team should do

• Immediately inventory internet-facing WordPress sites for Royal Elementor Addons and Templates and prioritize any version before 1.3.79.
• Patch to version 1.3.79 or later, or disable/remove the plugin if patching cannot be completed promptly.
• Treat vulnerable public sites as potentially compromised due to weaponized exploitation and high exploitation probability; perform compromise assessment, not just patching.
• Hunt for PHP files and suspicious scripts in wp-content/uploads, plugin upload folders, theme directories, and recently modified WordPress paths.
• Review web access logs for unauthenticated multipart uploads followed by HTTP requests to newly uploaded PHP files.
• Rotate WordPress administrator passwords, hosting control panel credentials, database credentials, and salts if compromise is suspected or confirmed.
• Disable PHP execution in writable upload directories and harden filesystem permissions across WordPress deployments.
• Deploy or tune WAF/SIEM detections for suspicious file uploads to WordPress plugin endpoints and direct access to PHP files under upload paths.
• Remove unauthorized admin users, unknown plugins, injected JavaScript, redirects, and any modified theme/plugin files found during review.