Unauthorized File Upload Vulnerability in Royal Addons for Elementor by WordPress
CVE-2025-11363
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 15 December 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-11363?
The Royal Addons for Elementor plugin prior to version 1.7.1037 is susceptible to a vulnerability that permits unauthenticated users to upload arbitrary media files via the wpr_addons_upload_file action. This lack of proper authorization can lead to potential exploitation, compromising the security of the WordPress installation and enabling malicious users to execute harmful actions.
Affected Version(s)
Royal Addons for Elementor 0 < 1.7.1037
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.