Input validation vulnerability in Royal Elementor Addons and Templates 1.3.78

The Royal Elementor Addons and Templates plugin for WordPress has a vulnerability that leaves it open to attack. All versions up to and including 1.3.78 are affected. Attackers can upload files to the server by using a specially crafted file extension in the ‘allowed_file_types’ parameter when calling the handle_file_upload() function via AJAX. This bypasses the filter list and allows unauthenticated attackers to upload arbitrary files to the server. This could potentially enable a remote code execution attack.