Critical King Addons Vulnerability Exploited to Hack WordPress Sites

A critical-severity vulnerability in the King Addons for Elementor plugin for WordPress has been exploited to take over websites, according to Defiant. Tracked as CVE-2025-8489 (CVSS 9.8), the flaw is a privilege-escalation issue affecting versions 24.12.92 to 51.1.14, with the maintainers patching in version 51.1.35 released on 25 September. Roughly a month after the patch, threat actors began targeting the CVE, with Defiant noting around 50,000 exploit attempts to date.

The flaw exists because the plugin’s registration-handling function was implemented insecurely, allowing unauthenticated attackers to specify their role and potentially grant themselves administrator privileges, leading to full site compromise and the ability to upload malicious files or redirect users. Security researchers reported that active exploitation may have begun as early as 31 October 2025, with mass exploitation starting on 9 November 2025.

King Addons for Elementor has over 10,000 active installs, and thousands of websites are still running a vulnerable version, prompting urgent updates to 51.1.35 or newer.