The Royal Addons for Elementor plugin for WordPress allows an authenticated attacker with author-level access or higher to upload a file named main.php due to insufficient file type validation in the main.php upload handler. This arbitrary file upload vulnerability corresponds to CWE-434 (Improper Validation of File Type or Extension) and can result in remote code execution if the uploaded file contains executable PHP code. The flaw directly exposes the server’s file system to unauthorized code execution, potentially compromising the entire site.

All releases of the Royal Addons for Elementor – Addons and Templates Kit for Elementor up to and including version 1.7.1049 are vulnerable. The plugin is distributed by wproyal. No information indicates that versions newer than 1.7.1049 address the issue, so any deployment using a version at or below this threshold is at risk.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is reported as less than 1%, suggesting a low probability of widespread exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires valid site credentials with author-level or higher privileges, making the attack vector internal. While the impact is high for privileged accounts, the overall risk scope is limited to sites that have not patched or removed the affected plugin.