CVE-2025-8489

CRITICAL EXPLOITED

King Addons for Elementor - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2025-8489 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Peter Thaleikis, Valentin Lobstein <[email protected]>, including a Metasploit module exploits/multi/http/wp_king_addons_privilege_escalation.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated privilege escalation vulnerability in the WordPress King Addons for Elementor plugin (versions 24.12.92 to 51.1.14) by creating an administrator account and uploading a malicious plugin for RCE.

Description

The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.

Exploits (1)

metasploit WORKING POC EXCELLENT
by Peter Thaleikis, Valentin Lobstein <[email protected]> · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_king_addons_privilege_escalation.rb

This Metasploit module exploits an unauthenticated privilege escalation vulnerability in the WordPress King Addons for Elementor plugin (versions 24.12.92 to 51.1.14) by creating an administrator account and uploading a malicious plugin for RCE.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: WordPress King Addons for Elementor plugin (versions 24.12.92 to 51.1.14)
No auth needed
Prerequisites: A WordPress page containing the King Addons 'Login Register Form' Elementor widget · Valid nonce token exposed in the page's JavaScript
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 9.8
EPSS 0.4926
EPSS Percentile 97.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

VulnCheck KEV 2025-10-31
CWE
CWE-269
Status published
Products (1)
kingaddons/King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor < 51.1.14
Published Oct 31, 2025
Tracked Since Feb 18, 2026