CVE-2025-8489: Elementor King Addons Privilege Escalation

CVE-2025-8489 Overview

CVE-2025-8489 is a critical privilege escalation vulnerability affecting the King Addons for Elementor plugin for WordPress. This vulnerability allows unauthenticated attackers to register accounts with administrator-level privileges due to improper role restriction during user registration. The vulnerability exists in versions 24.12.92 to 51.1.14 of the plugin and represents a severe security risk for WordPress sites utilizing this popular Elementor addon.

Critical Impact

Unauthenticated attackers can create administrator accounts, enabling complete site takeover, data theft, malware injection, and full compromise of the WordPress installation.

Affected Products

• King Addons for Elementor plugin versions 24.12.92 through 51.1.14
• WordPress sites running vulnerable versions of the plugin
• Sites using the Login/Register Form widget from King Addons

Discovery Timeline

• 2025-10-31 - CVE CVE-2025-8489 published to NVD
• 2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-8489

Vulnerability Analysis

This privilege escalation vulnerability (CWE-269: Improper Privilege Management) stems from insufficient role validation in the King Addons for Elementor plugin's user registration functionality. The plugin's Login/Register Form widget contains an AJAX handler that processes new user registrations without properly restricting the roles that can be assigned to newly created accounts.

The vulnerable code resides in Login_Register_Form_Ajax.php, where the registration logic fails to enforce role restrictions. When processing registration requests, the application accepts user-supplied role parameters without validating them against an allowlist of permitted roles. This allows attackers to specify administrative roles during registration, bypassing the intended security controls that should limit new registrations to subscriber-level accounts.

Root Cause

The root cause lies in the Login_Register_Form_Ajax.php file where user registration is handled. The plugin does not properly validate or sanitize the user role parameter during the registration process. Instead of enforcing a default role (typically "subscriber" for WordPress) or validating against permitted roles, the vulnerable code path allows arbitrary role assignment. This design flaw enables unauthenticated users to self-assign elevated privileges, including administrator access.

Attack Vector

The attack can be executed remotely over the network without any prior authentication or user interaction. An attacker simply needs to identify a WordPress site running a vulnerable version of King Addons for Elementor and send a crafted registration request to the AJAX endpoint. The request includes a manipulated role parameter specifying "administrator" or another privileged role.

The attack flow involves:

1. Identifying a target WordPress site with the vulnerable plugin installed
2. Locating the AJAX registration endpoint (/wp-admin/admin-ajax.php)
3. Crafting a POST request with registration data including an elevated role parameter
4. Submitting the request to create an administrator account
5. Logging in with the newly created credentials to gain full site control

Technical details regarding the vulnerable code can be found in the WordPress Plugin Repository - Version 24.12.93 and the patched version 51.1.35. For comprehensive analysis, refer to the Wordfence Threat Intelligence report.

Detection Methods for CVE-2025-8489

Indicators of Compromise

• Unexpected administrator accounts appearing in WordPress user management
• New user registrations with administrator or editor roles that were not manually created
• Unusual AJAX requests to admin-ajax.php with registration-related actions from the King Addons plugin
• Web server logs showing POST requests to registration endpoints with suspicious role parameters

Detection Strategies

• Monitor WordPress user creation events for accounts with elevated privileges (administrator, editor, author)
• Implement file integrity monitoring on the King Addons plugin directory to detect unauthorized modifications
• Review web application firewall (WAF) logs for POST requests containing role manipulation attempts
• Set up alerting for any new administrator account creation events

Monitoring Recommendations

• Enable WordPress audit logging to track user registration and role assignment activities
• Configure SentinelOne Singularity to monitor for suspicious PHP process behavior and file system changes
• Implement real-time alerting for new user accounts with administrative privileges
• Review access logs regularly for unusual patterns in AJAX endpoint requests

How to Mitigate CVE-2025-8489

Immediate Actions Required

• Update King Addons for Elementor to version 51.1.35 or later immediately
• Audit existing WordPress user accounts for any unauthorized administrator accounts created recently
• Remove or disable any suspicious user accounts that cannot be attributed to legitimate activity
• Temporarily disable the Login/Register Form widget if immediate patching is not possible

Patch Information

The vulnerability has been addressed in King Addons for Elementor version 51.1.35. Site administrators should update to this version or later through the WordPress plugin management interface. The patch implements proper role validation in the Login_Register_Form_Ajax.php file, ensuring that user-supplied role parameters are validated against an allowlist of permitted roles.

To verify the patch has been applied, check that your installed version is 51.1.35 or higher by navigating to Plugins > Installed Plugins in your WordPress admin dashboard.

Workarounds

• Disable the King Addons Login/Register Form widget until the patch can be applied
• Implement a Web Application Firewall (WAF) rule to block POST requests with elevated role parameters to the AJAX endpoint
• Restrict user registration capabilities at the WordPress level if not required for site operation
• Use security plugins like Wordfence to block known exploitation patterns

# Verify installed King Addons version via WP-CLI
wp plugin list --name=king-addons --fields=name,version,status

# Update King Addons to the latest patched version
wp plugin update king-addons

# List all administrator accounts to audit for suspicious entries
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered