{"api_version":"1","generated_at":"2026-07-24T20:59:03+00:00","cve":"CVE-2023-5360","urls":{"html":"https://cve.report/CVE-2023-5360","api":"https://cve.report/api/cve/CVE-2023-5360.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-5360","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-5360"},"summary":{"title":"CVE-2023-5360","description":"The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE.","state":"PUBLIC","assigner":"contact@wpscan.com","published_at":"2023-10-31 14:15:00","updated_at":"2023-11-08 18:41:00"},"problem_types":["CWE-434"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34","name":"https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34","refsource":"MISC","tags":[],"title":"Royal Elementor Addons and Templates < 1.3.79 – Unauthenticated Arbitrary File Upload | Plugin Vulnerabilities","mime":"text/html","httpstatus":"403","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5360","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5360","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"5360","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"royal-elementor-addons","cpe5":"royal_elementor_addons","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"wordpress","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2023-5360","qid":"150736","title":"WordPress Royal Elementor Addons Plugin: Unauthenticated Arbitrary File Upload Vulnerability (CVE-2023-5360)"}]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2023-5360","ASSIGNER":"contact@wpscan.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-434 Unrestricted Upload of File with Dangerous Type"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Unknown","product":{"product_data":[{"product_name":"Royal Elementor Addons and Templates","version":{"version_data":[{"version_affected":"<","version_name":"0","version_value":"1.3.79"}]}}]}}]}},"references":{"reference_data":[{"url":"https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34","refsource":"MISC","name":"https://wpscan.com/vulnerability/281518ff-7816-4007-b712-63aed7828b34"}]},"generator":{"engine":"WPScan CVE Generator"},"source":{"discovery":"EXTERNAL"},"credits":[{"lang":"en","value":"Fioravante Souza"},{"lang":"en","value":"WPScan"}]},"nvd":{"publishedDate":"2023-10-31 14:15:00","lastModifiedDate":"2023-11-08 18:41:00","problem_types":["CWE-434"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:*","versionEndExcluding":"1.3.79","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}