CVE-2023-5360

The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

81.69% chance of exploitation in the next 30 days, 100th percentile

Nuclei

critical · CWE-434

Published

2023-10-31

Updated

2025-02-13

Proof-of-concept exploits (10)

• https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34
• Chocapikk/CVE-2023-536010★ · 2023-11-02
• Jenderal92/WP-CVE-2023-53600★ · 2026-05-30
• MataKucing-OFC/NemesisTools52★ · 2025-01-08
• Pushkarup/CVE-2023-53605★ · 2023-11-05
• X3RX3SSec/CVE-2023-53602★ · 2025-07-15
• nastar-id/CVE-2023-53600★ · 2023-10-26
• phankz/Worpress-CVE-2023-536013★ · 2023-11-30
• sagsooz/CVE-2023-53603★ · 2023-10-21
• LaviruDilshan/CVE-2023-5360-exploit-with-native-libraries

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5360.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_royal_elementor_ad…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52127

References

• CVE Record
• NVD entry

Related

• CVE-2023-23752
• CVE-2023-2732
• CVE-2023-27350
• CVE-2023-28121
• CVE-2023-32243
• CVE-2023-34960