CVE-2025-8489
CRITICAL EXPLOITEDKing Addons for Elementor - Privilege Escalation
Title source: llmExploitation Summary
CVE-2025-8489 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 1 public exploit from researchers including Peter Thaleikis, Valentin Lobstein <[email protected]>, including a Metasploit module exploits/multi/http/wp_king_addons_privilege_escalation.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated privilege escalation vulnerability in the WordPress King Addons for Elementor plugin (versions 24.12.92 to 51.1.14) by creating an administrator account and uploading a malicious plugin for RCE.
Description
The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.
Exploits (1)
This Metasploit module exploits an unauthenticated privilege escalation vulnerability in the WordPress King Addons for Elementor plugin (versions 24.12.92 to 51.1.14) by creating an administrator account and uploading a malicious plugin for RCE.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H