CVE-2024-1567 is a high severity (CVSS 8.2) file upload flaw in the Royal Elementor Addons and Templates plugin for WordPress, versions up to and including 1.3.94. Unauthenticated attackers can upload dangerous file types such as svgz, which may enable cross-site scripting or code execution. The fix appears in version 1.3.95.
What's affected
The record says all versions up to and including 1.3.94 are affected. The record's references include a plugin changeset for tag 1.3.95 that compares code with 1.3.94, which points to 1.3.95 as the release that changed the upload validation. I did not retrieve the changeset, so confirm the fix in the plugin changelog.
The weak point is the file_validity function, which lacked proper file type checking. The vulnerable form upload feature can be reached without logging in.
How to check if you're exposed
List the plugin version with WP-CLI:
wp plugin list --name=royal-elementor-addons --fields=name,status,version
Any version up to 1.3.94 is affected. Look in the uploads directory for odd files such as svgz or script files you did not add, and check access logs for upload requests from the plugin's form endpoint.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the plugin version on each site.
- Update to 1.3.95 or later.
- Search the uploads directory for unexpected files and remove them after review.
- Prevent script execution in the uploads directory at the web server.
- Consider blocking svg and svgz uploads site wide if you do not need them.
Why it matters
The class is CWE-434, unrestricted upload of a file with a dangerous type. The plugin accepted types it should have refused. SVG files can carry script, and if one is served from your domain, visitors who open it run that script in your site's context.
The record also mentions remote code execution as possible, depending on what the server will run. Because no account is needed, the score reflects broad reach. The record's KEV flag is false.
Quick check
Is a login required?
No. The record says unauthenticated attackers can upload.
Which version fixes it?
The record's references point to 1.3.95. Confirm in the changelog.
Sources
- Plugin changeset for 1.3.95 (listed in the NVD record, not retrieved)
- Wordfence entry (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1567
Last reviewed: 19 October 2026.
