Security Alert Summary
The Royal Addons for Elementor WordPress plugin contains an authorization issue that allows unauthenticated users to upload media files using the wpr_addons_upload_file action. The issue affects versions before 1.7.1037 and is documented in the referenced CVE entry.
CVE Details
- CVE ID: CVE-2025-11363
- Affected component: Royal Addons for Elementor WordPress plugin
- Affected versions: Versions before 1.7.1037
- Published: December 15, 2025, 6:15:42 AM UTC
- Last modified: December 15, 2025, 6:22:13 PM UTC
- CVSS v3.1 base score: 5.3
- CVSS v3.1 severity: MEDIUM
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication required: None (unauthenticated)
- Privileges required: None
- User interaction: None
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness ID: Not specified in the CVE entry
Technical Details
According to the CVE description, the plugin “does not have proper authorisation,” which allows unauthenticated users to upload media files via the wpr_addons_upload_file action. In other words, a missing or insufficient authorization check on that upload action permits public access to functionality intended for authenticated users. The CVE entry does not name specific PHP functions beyond the action or provide additional implementation details.
The practical effect, as reflected in the CVSS vector, is a low integrity impact: unauthorized content can be added to the site (media files), but the entry does not indicate any direct confidentiality or availability impact.
How This Could Impact Your Website
Consider a small site with a site owner, internal content editors, and external contractors who provide images. An unauthenticated attacker could use the exposed upload action to add media files to the site. Uploaded files might be used to alter displayed content or to host images and pages that could support deceptive content.
While the CVSS score indicates no confidentiality impact for this vulnerability (C:N), uploaded content could still be leveraged in targeted phishing or social engineering campaigns by presenting convincing imagery or links to users. This vulnerability does not, by itself, indicate disclosure of internal user email addresses, but any uploaded content that is visible to users could increase opportunities for deception.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry specifies affected versions are before 1.7.1037.)
- Review and reduce unnecessary user roles and capabilities, especially for contributor and lower-privileged accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and uploads for unusual behavior (unexpected new media files, unfamiliar filenames, or suspicious metadata).
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
