CVE-2025-13067 affects the Royal Addons for Elementor plugin for WordPress, allowing authenticated users with author-level privileges or above to upload arbitrary files because the plugin fails to properly validate file types. Files named main.php can bypass the sanitization process, which may lead to remote code execution on the server hosting the affected WordPress site. This vulnerability is present in all versions up to and including 1.7.1049. The CVSS 3.1 base score is 8.8, reflecting a high severity with network attack vector, low attack complexity, and significant impact on confidentiality, integrity, and availability.

An attacker with author-level access or higher can upload arbitrary files, including potentially malicious PHP scripts, to the server. This can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability allows an attacker to execute code remotely, which could result in full system compromise depending on the server configuration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level user permissions and monitor for suspicious file uploads. Avoid granting author-level access to untrusted users. Follow updates from the vendor wproyal for an official patch or temporary mitigation.