CVE-2025-8489

King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation

2025-10-30 00:00
Peter Thaleikis

Strategic Overview

Status
Patched in 51.1.35
Affected Plugin
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder
Affected Version
24.12.92 – 51.1.14
CVSS
9.8Critical
Weakness type
CWE-269 · Improper Privilege Management
CVE
CVE-2025-8489
View all King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder vulnerabilities

At a glance

CVE-2025-8489 is a critical-severity Improper Privilege Management vulnerability in the King Addons for Elementor WordPress plugin, affecting versions 24.12.92 – 51.1.14. It carries a CVSS score of 9.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires no authentication. The issue is fixed in version 51.1.35; sites on affected versions should update now. Disclosed October 2025, reported by Peter Thaleikis.

Vulnerability Overview

The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.

CWE-269: Improper Privilege Management

Reaching this weakness in King Addons for Elementor 24.12.92 – 51.1.14 takes no account at all. Improper privilege management means the code lets an account end up with capabilities its role should not have.

It converts a low-privileged account into an administrative one, which makes every other restriction on the site irrelevant. For King Addons for Elementor the fix is 51.1.35: builds 24.12.92 – 51.1.14 are affected, anything from 51.1.35 onward is not.

Remediation

Update to version 51.1.35, or a newer patched version

How does WordSec protect against this?

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: King Addons for Elementor 51.1.35 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2025-8489https://www.wordfence.com/threat-intel/vulnerabilities/id/a1bb2b06-9a3b-4428-8624-26a1202fe3b0https://nvd.nist.gov/vuln/detail/CVE-2025-8489

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C