WordPress King Addons for Elementor Unauthenticated Privilege Escalation to RCE

MetasploitMetasploit exploitExploitRubyexploit_multi/http/wp_king_addons_privilege_escalation

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit module exploits CVE-2025-8489, an unauthenticated privilege escalation vulnerability in the WordPress King Addons for Elementor plugin. It creates an administrator account by sending a crafted registration request with the 'user_role' parameter set to 'administrator', then uploads and executes a malicious plugin to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The module exploits a documented privilege escalation vulnerability (CVE-2025-8489) in the King Addons for Elementor WordPress plugin. It registers an administrator account via the vulnerable AJAX handler, logs in, and uploads a Metasploit-generated plugin to execute a payload. All behavior aligns with the stated exploit purpose; no concealed backdoor, unrelated remote access, persistence, or deceptive payload targeting the operator was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesRuby
Target softwareWordPressKing Addons for Elementor plugin
Attack typesprivilege escalationremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that actively creates an administrator account and deploys a payload for remote code execution. It includes methods for registration, login, and payload upload/execution, which are characteristic of exploit code.

modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:102-115modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:156-174modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:199-211

Requirements

  • Target must be running WordPress with the King Addons for Elementor plugin (versions 24.12.92 to 51.1.14).modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:23
  • A WordPress page containing the King Addons 'Login Register Form' Elementor widget must exist to expose the required nonce token.modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:27-29

Observed behavior

  • Sends a POST request to the WordPress admin-ajax endpoint with action 'king_addons_user_register' and 'user_role' set to 'administrator' to create a privileged account.modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:160-173
  • Logs in to WordPress with the newly created administrator credentials.modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:107
  • Generates a malicious plugin containing a payload, uploads it via the WordPress plugin upload functionality, and triggers execution by requesting the payload file.modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:199-210
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Registers a WordPress user with role 'administrator' via AJAX endpoint king_addons_user_registerCore exploit step matching the described CVE-2025-8489 privilege escalationmodules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:156-174
Exploit Behavior
Logs in with the created administrator credentials and uploads a malicious plugin to achieve RCEStandard Metasploit post-authentication payload delivery via plugin uploadmodules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:107-114
Payload Delivery
Uses wordpress_upload_plugin and generate_plugin to deploy a Metasploit payloadPayload is generated by the framework, not hardcoded; no hidden second-stage downloadermodules/exploits/multi/http/wp_king_addons_privilege_escalation.rb:199-210
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Ruby source code and metadata; framework mixins, libraries, and external payloads are not expanded, so the full execution chain is not visible.
  • The artifact is not executed; classification is based on static analysis of the code's intended purpose.
  • Framework mixins (e.g., Msf::Exploit::FileDropper, wordpress_upload_plugin, generate_plugin) are not expanded; their implementation is assumed to match documented Metasploit behavior.
  • Only the module source and metadata were reviewed; no runtime behavior or network traffic was observed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1