King Addons flaw lets anyone become WordPress admin

Hackers are exploiting a critical vulnerability in the King Addons for Elementor WordPress plugin (CVE-2025-8489) that lets unauthenticated users register with administrator-level privileges, potentially taking full control of a site. The flaw affects versions 24.12.92 to 51.1.14 and arises from improper restriction of registration roles in the plugin’s handle_register_ajax function, allowing an attacker to request an administrator account via /wp-admin/admin-ajax.php.

The flaw has a CVSS score of 9.8, and the plugin is installed on over 10,000 websites. Security researcher Peter Thaleikis reported the vulnerability, and Wordfence researchers warn that threat actors are actively exploiting it; according to Wordfence Intelligence vulnerability database, the vendor released a patched version on 25 September 2025, with exploitation beginning around 31 October 2025 and mass activity spiking on 9–10 November 2025.

Wordfence has blocked over 48,400 exploit attempts, with top attacking IPs including 45.61.157[.]120 (about 28,900 blocks) and 2602:fa59:3:424::1 (about 16,900 blocks).