Critical WordPress Plugin Flaw (CVE-2025-8489, CVSS 9.8) Allows Unauthenticated Admin Takeover

The Daily CyberSecurity reports a critical vulnerability in the King Addons for Elementor plugin (CVE-2025-8489, CVSS 9.8), described as an unauthenticated privilege escalation that allows takeover of an affected site. According to Wordfence, the flaw stems from a basic coding oversight in the plugin’s registration functionality, with versions 24.12.92 to 51.1.14 failing to restrict the user role during registration.

An unauthenticated attacker can exploit this by adding the role parameter (user_role=administrator) when registering a new account, gaining full control of the website, including the ability to install malicious plugins and change content. The vulnerability is already under active assault in the wild, with Wordfence reporting 170 attacks targeting this specific vulnerability in the past 24 hours. All users are advised to update to the patched version 51.1.35 or later to safeguard against a total takeover. The article notes the plugin is popular, used by over 10,000 active WordPress installations.