Vulnerability · Published Oct 31, 2025 · Assigned by Wordfence

CVE-2025-8489King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation

Critical 9.8

In plain English

A critical-severity privilege mismanagement in King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor from kingaddons. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.6% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)9.6%top 4.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Metasploit

Official description

The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.

Affected products (as reported)

Vendor	Product	Versions
kingaddons	King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor	* – through 51.1.14

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References