Critical flaw in WordPress add-on for Elementor exploited in attacks
Recorded: Dec. 4, 2025, 1:02 a.m.
| Original | Summarized |
Critical flaw in WordPress add-on for Elementor exploited in attacks News Featured North Korea lures engineers to rent identities in fake IT worker scheme Shai-Hulud 2.0 NPM malware attack exposed up to 400,000 dev secrets Microsoft "mitigates" Windows LNK flaw exploited as zero-day University of Phoenix discloses data breach after Oracle hack Russia blocks FaceTime and Snapchat over use in terrorist attacks Create compliance docs with this $40 governance & cybersecurity bundle CISA warns of Chinese "BrickStorm" malware attacks on VMware servers Contractors with hacking records accused of wiping 96 govt databases Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityCritical flaw in WordPress add-on for Elementor exploited in attacks Critical flaw in WordPress add-on for Elementor exploited in attacks By Bill Toulas December 3, 2025 Attackers are exploiting a critical-severity privilege escalation vulnerability (CVE-2025–8489) in the King Addons for Elementor plugin for WordPress, which lets them obtain administrative permissions during the registration process. Malicious requestSource: Wordfence Break down IAM silos like Bitpanda, KnowBe4, and PathAI Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories ChatGPT is down worldwide, conversations disappeared for users Marquis data breach impacts over 74 US banks, credit unions Glassworm malware returns in third wave of malicious VS Code packages Sponsor Posts Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe! Empowering IT teams with intelligence driven cyber threat research. Overdue a password health-check? Audit your Active Directory for free AI is a data-breach time bomb: Read the new report Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
The security landscape for WordPress websites is currently facing significant vulnerabilities, as highlighted by a recent incident involving the King Addons for Elementor plugin. This report details a critical privilege escalation flaw (CVE-2025-8489) that enabled attackers to gain administrative access to websites using the plugin. The vulnerability, discovered by Peter Thaleikis, originated with a crafted ‘admin-ajax.php’ request specifying ‘user_role=administrator,’ leading to the creation of rogue administrator accounts. Between October 31 and November 10, activity peaked with 28,900 and 16,900 attempts respectively, traced to specific IP addresses – 45.61.157.120 and 2602:fa59:3:424::1 – and documented by Wordfence. The incident underscores a broader concern, as Wordfence researchers identified another, separate critical vulnerability within the Advanced Custom Fields: Extended plugin (CVE-2025-13486), affecting versions 0.9.0.5 through 0.9.1.1. This flaw, discovered and responsibly reported by Marcin Dudek, allows unauthenticated attackers to execute arbitrary code on the server via the function accepting user input and passing it through call_user_func_array(). This highlights the potential for remote code execution in previously vulnerable plugins. The timeline of events is crucial: the initial flaw in King Addons was publicly disclosed on October 31, followed by a surge in exploitation activity. The Advanced Custom Fields: Extended vulnerability was reported on November 18, and version 0.9.2 of the plugin, addressing this issue, was released a day later. Given the ease of exploitation – only requiring a crafted request – the public disclosure of technical details likely triggered a significant increase in malicious activity, further emphasizing the importance of rapid response and proactive security measures. The immediate recommendations from Wordfence are to upgrade to version 51.1.35 of King Addons and/or disable the plugin entirely for impacted websites. Monitoring website logs for the presence of new administrator accounts is strongly advised. This incident serves as a broader reminder for WordPress users to maintain vigilance, regularly update all plugins, and implement robust security practices. Furthermore, the details surrounding this event reinforce the need for comprehensive vulnerability management strategies, particularly when utilizing third-party plugins. It is important to note that this is part of an ongoing pattern of vulnerabilities within WordPress plugins, stressing the need for diligence and careful selection of approved and well-maintained plugins, alongside active monitoring for emerging threats. |