Description

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-20T06:16:41.710Z",
  "pubdate": "2026-08-20T06:16:41.710Z",
  "executiveSummary": "An authenticated Remote Code Execution (RCE) vulnerability exists in the Royal Addons for Elementor WordPress plugin affecting versions prior to 1.7.1066. The vulnerability arises due to the improper sanitization of custom widget markup prior to writing the data to a file that is subsequently executed by the server. This security flaw enables authenticated users possessing the manage_options capability, as well as non-super subsite administrators in a WordPress Multisite configuration who typically lack direct code-execution capabilities, to execute arbitrary PHP code on the underlying host operating system.\nThe risk implications are severe, as successful exploitation grants an attacker full administrative control over the affected WordPress installation and potentially the underlying web server environment. The attack requires authenticated access with specific administrative or subsite administrator privileges, but effectively bypasses standard privilege boundaries designed to restrict code execution within multisite architectures.\nMitigation requires updating the Royal Addons for Elementor plugin to version 1.7.1066 or later, where proper sanitization and handling of custom widget markup have been implemented.",
  "technicalDetails": "The root cause of the vulnerability lies in inadequate input sanitization and insecure file write operations within the custom widget markup handling functionality of the Royal Addons for Elementor plugin. When administrative users or subsite administrators define or modify custom widget markup, the application fails to adequately strip or neutralize executable PHP syntax before persisting the input to a file on the filesystem.\nThe vulnerable component involves the internal mechanism responsible for processing, storing, and subsequently including or executing files generated from custom widget configurations. Because the resulting file is later executed by the server runtime, any malicious PHP payloads embedded within the custom widget markup are interpreted and executed with the permissions of the web server user.\nThe attack flow proceeds as follows: 1) An authenticated attacker with the manage_options capability, or a subsite administrator within a WordPress Multisite environment, crafts a malicious payload containing arbitrary PHP code disguised as custom widget markup. 2) The attacker submits this payload to the vulnerable endpoint within the Royal Addons for Elementor plugin. 3) The plugin processes the input without proper sanitization and writes the raw markup to a file designated for later execution. 4) Upon invocation or automatic inclusion of the generated file, the web server executes the embedded PHP code, achieving full code execution.\nAuthentication and privilege requirements involve holding the manage_options capability or operating as a non-super subsite administrator in a WordPress Multisite context. Network exposure is standard HTTP/HTTPS access to the WordPress administrative interface or relevant plugin endpoints. Post-exploitation impact includes complete system compromise, data exfiltration, modification of database contents, and deployment of secondary web shells."
}