WordPress King Addons Flaw Under Active Attack Lets Hackers Make Admin Accounts

A critical flaw in the WordPress King Addons for Elementor plugin is currently being actively exploited in the wild. The vulnerability, CVE-2025-8489 (CVSS 9.8), is a privilege-escalation flaw that lets unauthenticated attackers grant themselves administrative privileges by selecting the administrator role during registration. It affects versions from 24.12.92 through 51.1.14 and was patched in version 51.1.35, released on 25 September 2025.

The plugin has over 10,000 active installs, and security researcher Peter Thaleikis is credited with discovering and reporting the flaw. According to Wordfence, the flaw has seen more than 48,400 exploit attempts blocked since public disclosure in late October 2025, with 75 attempts blocked in the last 24 hours; attacks have originated from several IPs listed by the firm.

Administrators are urged to run the latest version, audit for suspicious admin users, and monitor for abnormal activity, as attackers may have started targeting as early as 31 October 2025, with mass exploitation from 9 November 2025.