lavirudilshan/cve-2023-5360-exploit-with-native-librariesCVE-2023-5360 PoC: Unauthenticated arbitrary file upload leading to RCE in Royal Elementor Addons (≤ 1.3.78), written in pure Python.
This repository contains a modified proof-of-concept exploit for the WordPress plugin
Royal Elementor Addons and Templates (versions ≤ 1.3.78).
The vulnerability allows unauthenticated arbitrary file upload, which can be abused to upload a PHP file and achieve Remote Code Execution (RCE).
This version is a fully rewritten variant of the original exploit with the following changes:
requests, rich, etc.)requests → urllib.requestrich output → native print()ssl moduleAll original exploitation logic remains intact.
The plugin exposes an AJAX endpoint:
This endpoint:
By abusing the allowed_file_types parameter and using a crafted filename
(e.g. ph$p), it is possible to upload a PHP file that executes on the server.
WprConfig JavaScript objectNo additional Python libraries required.
python3 exploit.py -u https://target-site.com/
python3 exploit.py -u https://target-site.com/ -f shell.php
[+] Shell uploaded successfully: https://target-site.com/wp-content/uploads/royal-addons/poc.ph$p
[>] Access it with: ?cmd=id
This code is provided strictly for educational purposes, security research, and authorized testing only.
❌ Do NOT use against systems you do not own or have explicit permission to test
❌ Unauthorized use may be illegal
✅ The author is not responsible for misuse