Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-29 | 1 | Active Exploitation1 |
| 2026-07-08 | 1 | General1 |
| 2026-08-05 | 1 | Active Exploitation1 |
Critical #WordPress Vulnerability: Admin Takeover Risk https://blog.quttera.com/post/wordpress-cve-2025-8489-admin-takeover-vulnerability
Post summary
The post simply announces a critical WordPress vulnerability (CVE‑2025‑8489) without providing detailed technical data, exploitation evidence, or remediation information.
A critical security flaw impacting a WordPress plugin known as King Addons for Elementor has come under active exploitation in the wild. The vulnerability, CVE-2025-8489 (CVSS score: 9.8), is a case of privilege escalat... https://f.mtr.cool/wlcifzvwsh
Post summary
CVE-2025-8489 is a privilege escalation flaw in the King Addons for Elementor plugin, rated 9.8 CVSS, and is presently being actively exploited in the wild.
WordPress Security Alert: CVE-2025-8489 (Admin Takeover) https://nvd.nist.gov/vuln/detail/CVE-2025-8489 A critical flaw in the King Addons for Elementor plugin lets unauthenticated attackers create admin accounts — no login required. (The Hacker News) What’s the risk? 👉 Full website takeover 👉 Malware injection & webshell deployment 👉 Payment skimmers, redirects, SEO spam 👉 Total loss of customer trust & revenue Root cause: The plugin fails to validate user roles during registration, allowing attackers to assign themselves administrator privileges. Real-world impact: ⚠️ Exploited in the wild within days ⚠️ 48,000+ attack attempts observed (BleepingComputer) ⚠️ Thousands of WordPress sites exposed How to protect your site: ✅ Update immediately (patched ≥ 51.1.35) ✅ Audit users for rogue admin accounts ✅ Monitor /wp-admin/admin-ajax.php activity ✅ Deploy full perimeter security scanning 🔎 Detect hidden backdoors & privilege abuse early: https://quttera.com/wordpress-malware-scanner #WordPress #CyberSecurity #CVE #WooCommerce #Malware #Infosec
Post summary
The post announces that CVE-2025-8489 in the King Addons for Elementor plugin is actively exploited, resulting in admin takeover, and urges immediate patching.