King Addons flaw lets anyone become WordPress admin

Securityaffairs • December 3, 2025

Wordfence researchers warn that threat actors are actively exploiting the vulnerability. ... Iran-linked threat actor MuddyWater targeted multiple ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical King Addons Vulnerability Allows Unauthorized WordPress Admin Access A vulnerability in the King Addons for Elementor WordPress plugin, tracked as CVE-2025-8489, allows unauthenticated users to register and gain admin privileges on affected sites. This flaw, with a CVSS score of 9.8, is currently being exploited by hackers, including a group linked to Iran known as MuddyWater. Site administrators are urged to take immediate action to secure their installations. 2 sources 25

Extracted Entities

King Addons flaw lets anyone become WordPress admin

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Countries (1)

Platforms (1)

Vulnerabilities (1)