Attackers are actively exploiting a critical privilege escalation flaw (CVE-2025-8489) in the King Addons for Elementor plugin — allowing hackers to register new admin accounts and take full control of vulnerable WordPress sites.
🔍 What’s happening:
- Exploitation began one day after disclosure (October 31).
- Over 48,400 malicious attempts have already been blocked by Wordfence.
- Attack uses a crafted admin-ajax.php request with
user_role=administrator. - Two IPs alone account for ➜ 45.61.157.120 (28.9k attacks) and 2602:fa59:3:424::1 (16.9k attacks).
🔧 Who’s at risk:
King Addons (installed on ~10,000 sites) allows attackers to bypass role restrictions and instantly create rogue administrator accounts.
✅ Fix:
Update to King Addons v51.1.35 immediately.
⚠️ Second Critical Plugin Vulnerability — CVE-2025-13486
Another severe flaw impacts Advanced Custom Fields: Extended (100,000+ sites).
This unauthenticated RCE vulnerability allows attackers to:
- Execute arbitrary PHP code
- Drop backdoors
- Create admin users
📌 Affected versions: 0.9.0.5 – 0.9.1.1
📌 Fixed in: 0.9.2 (released one day after report)
🔧 Action required:
Update the plugin immediately or disable it until a patch is available.
🛡️ What website owners should do now:
✔ Update both plugins to their latest secure versions
✔ Check logs for suspicious IPs
✔ Verify no new admin accounts exist
✔ Enable a WAF (Wordfence, Sucuri, Cloudflare)
✔ Review user registration settings
WordPress attacks spike as soon as exploits go public — patching today is critical.
