PT-2023-6274 · WordPress · The Royal Elementor Addons/Templates

Fioravante Souza · Published 2023-10-03 · Updated 2023-11-29 · CVE-2023-5360

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Royal Elementor Addons and Templates versions prior to 1.3.79

Description The issue is related to unlimited file upload of dangerous types. Exploitation of this issue may allow a remote attacker to execute arbitrary code by uploading a specially crafted PHP file. Unauthenticated users can upload arbitrary files, such as PHP, which could lead to remote code execution. Over 46K attacks have been blocked in a month, indicating the severity of the issue.

Recommendations For versions prior to 1.3.79, update to version 1.3.79 to protect the WordPress website and perform website cleanup to remove malicious files. As a temporary workaround, consider restricting access to the file upload functionality until the issue is resolved. Avoid using the vulnerable plugin until the issue is fixed by updating to the latest version. At the moment, there is no other information about additional mitigation measures.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-06984

CVE-2023-5360

Affected Products

The Royal Elementor Addons/Templates

References · 32

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_royal_elementor_addons_rce.rb · Exploit
• 🔥 https://github.com/phankz/Worpress-CVE-2023-5360 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-5360 · Exploit
• 🔥 https://github.com/sagsooz/CVE-2023-5360 · Exploit
• 🔥 https://github.com/Pushkarup/CVE-2023-5360 · Exploit
• 🔥 https://github.com/tucommenceapousser/CVE-2023-5360 · Exploit
• 🔥 https://github.com/IRB0T/CVE-Scan/tree/main/CVE-2023-5360-Scan · Exploit
• 🔥❌ https://github.com/1337r0j4n/CVE-2023-5360 · Exploit, Deleted
• 🔥 https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34 · Exploit
• https://bdu.fstec.ru/vul/2023-06984 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5360 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5360 · Security Note
• https://t.me/ckure/13102 · Telegram Post
• https://t.me/pentestingnews/40187 · Telegram Post
• https://twitter.com/TodayCyberNews/status/1714576283265593376 · Twitter Post