King Addons flaw lets anyone become WordPress admin

Securityaffairs.Co •Pierluigi Paganini • December 3, 2025

Hackers are exploiting a King Addons flaw (CVE-2025-8489) that lets anyone register and instantly gain admin privileges on WordPress sites. Hackers are exploiting a critical vulnerability, tracked as CVE-2025-8489 (CVSS score of 9.8), in the WordPress plugin King Addons for Elementor that allows unauthenticated users to create admin accounts via a registration privilege bug. King […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical King Addons Vulnerability Allows Unauthorized WordPress Admin Access A vulnerability in the King Addons for Elementor WordPress plugin, tracked as CVE-2025-8489, allows unauthenticated users to register and gain admin privileges on affected sites. This flaw, with a CVSS score of 9.8, is currently being exploited by hackers, including a group linked to Iran known as MuddyWater. Site administrators are urged to take immediate action to secure their installations. 2 sources 25

Extracted Entities

King Addons flaw lets anyone become WordPress admin

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (2)