Royal Addons for Elementor Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file upload has been identified in the Royal Addons for Elementor plugin for WordPress, affecting all versions through 1.7.1049. The issue arises from inadequate file type validation, which fails to properly sanitize files named 'main.php'. This flaw enables authenticated attackers with author-level access or higher to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for arbitrary file upload, with the potential for remote code execution if the uploaded file is executed on the server.

Remediation

Users are advised to update the Royal Addons for Elementor plugin to version 1.7.1050 or later.