Critical Elementor Plugin Flaw (CVE-2025-8489, CVSS 9.8) Under Active Exploitation Allows Unauthenticated Admin Takeover

A critical flaw in King Addons for Elementor, CVE-2025-8489 with a CVSS of 9.8, is under active exploitation and can allow unauthenticated admins takeover on affected sites. The vulnerability stems from a lack of input validation in the user registration process, where the handle_register_ajax() function could accept a user_role value without restrictions, enabling an attacker to grant themselves administrator privileges by including user_role=administrator in the registration request, according to Wordfence.

The plugin is installed on over 10,000 sites, and attackers began exploiting the issue the day after a patch was released, with the first public disclosure on 30 October 2025 and attacks commencing on 31 October 2025. Wordfence notes that the firewall has blocked over 48,400 exploit attempts targeting this vulnerability, and administrators are advised to review logs for anomalous activity from specific IPs such as 45.61.157[.]120 and 2602:fa59:3:424::1. The vulnerability affects plugin versions 24.12.92 to 51.1.14 and was patched in version 51.1.35.