A critical arbitrary file upload vulnerability in the Royal Addons for Elementor plugin for WordPress enables authenticated attackers with author-level access or higher to achieve remote code execution.

The vulnerability is an unrestricted upload of a file with a dangerous type (CWE-434). It occurs because the plugin fails to properly validate files named main.php, allowing attackers to bypass security sanitization and upload malicious scripts.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the underlying web server. This poses a severe risk of total system compromise, including unauthorized data access, modification of site content, and potential lateral movement within the hosting environment. The CVSS score of 8.8 reflects the high severity of the potential impact on confidentiality, integrity, and availability.

Immediate Action: Update the Royal Addons for Elementor plugin to the latest version, ensuring it is beyond 1.7.1049, as provided in the vendor security patch.

Proactive Monitoring: Monitor server access logs for requests targeting unusual file extensions or direct access to uploaded directories, and review user accounts to ensure only authorized personnel hold author-level or higher permissions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious file uploads and restrict direct execution of scripts within the uploads directory.

Public Exploit Available: No (exploit_available unknown).

Given the potential for remote code execution, this vulnerability represents a significant threat to the security of the WordPress instance. Administrators must prioritize updating the plugin immediately to the latest patched version. If an update is not immediately feasible, restrict access to administrative and author-level functions to mitigate the risk of unauthorized exploitation.