by Kastro
Paper/Archive/CVE-2023-5360

CVE-2023-5360

Unknown Royal Elementor Addons and Templates — Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload

EPSS 86%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.7.997 × 2019.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.

Affected

ProductAffectedFixed inSource
Royal Elementor Addons and Templates< 1.3.791.3.79CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

exploitwpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34refpacketstormsecurity.com/files/175992/WordPress-Royal-Elementor-Addons-And-Templates-Remote-Shell-Upload.html