CVE-2023-5360 – This vulnerability in the Royal Elementor Addon... (How to Fix)

Q: What is the severity of CVE-2023-5360?

CVE-2023-5360 has a CVSS score of 9.8 (CRITICAL). This vulnerability in the Royal Elementor Addons and Templates WordPress plugin allows unauthenticated attackers to upload arbitrary files, including PHP shells, leading to remote code execution. It affects WordPress sites using vulnerable versions of this plugin. The high CVSS score reflects the ease of exploitation and severe impact.

📋 TL;DR

This vulnerability in the Royal Elementor Addons and Templates WordPress plugin allows unauthenticated attackers to upload arbitrary files, including PHP shells, leading to remote code execution. It affects WordPress sites using vulnerable versions of this plugin. The high CVSS score reflects the ease of exploitation and severe impact.

💻 Affected Systems

Products:

WordPress Royal Elementor Addons and Templates plugin

Versions: All versions before 1.3.79

Operating Systems: All platforms running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires the plugin to be installed and activated on WordPress sites.

📦 What is this software?

Royal Elementor Addons by Royal Elementor Addons

View all CVEs affecting Royal Elementor Addons →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise, data theft, malware deployment, and persistent backdoor access leading to full site takeover.

🟠

Likely Case

Website defacement, data exfiltration, cryptocurrency mining, or ransomware deployment on vulnerable sites.

🟢

If Mitigated

Limited impact if proper file upload restrictions and web application firewalls are in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit code is publicly available and requires minimal technical skill to execute.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.3.79

Vendor Advisory: https://wordpress.org/plugins/royal-elementor-addons/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Royal Elementor Addons and Templates'. 4. Click 'Update Now' if available, or download version 1.3.79+ from WordPress repository. 5. Activate the updated plugin.

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Royal Elementor Addons and Templates plugin until patched.

wp plugin deactivate royal-elementor-addons

Restrict file uploads via .htaccess

linux

Block PHP file uploads to the vulnerable upload directory.

<FilesMatch "\.(php|php5|php7|phtml|phar)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

🧯 If You Can't Patch

Implement a web application firewall (WAF) with file upload filtering rules.
Restrict network access to the WordPress admin interface using IP whitelisting.

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Royal Elementor Addons and Templates version number.

Check Version:

wp plugin get royal-elementor-addons --field=version

Verify Fix Applied:

Confirm plugin version is 1.3.79 or higher in WordPress admin.

📡 Detection & Monitoring

Log Indicators:

Unusual file uploads to /wp-content/uploads/royal-elementor-addons/
POST requests to /wp-admin/admin-ajax.php with file upload parameters
Execution of unexpected PHP files in upload directories

Network Indicators:

HTTP POST requests with file uploads to WordPress admin endpoints from unauthenticated sources

SIEM Query:

source="web_logs" AND (uri_path="/wp-admin/admin-ajax.php" AND method="POST" AND (form_data CONTAINS "file" OR form_data CONTAINS "upload"))

📊 Metadata

CVE ID: CVE-2023-5360

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

Published: October 31, 2023

Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-5360, you might also want to check these: