Perceptive Security
SOC/SIEM Consultancy
Critical flaw in WordPress add-on for Elementor exploited in attacks
Published:
3 December 2025 at 21:31:20
Alert date:
5 December 2025 at 08:03:23
Source:
bleepingcomputer.com
Attackers are actively exploiting a critical privilege escalation vulnerability (CVE-2025-8489) in the King Addons for Elementor plugin for WordPress. The flaw allows attackers to gain administrative permissions during the user registration process. This is a critical severity vulnerability that is being exploited in live attacks against WordPress sites using this popular Elementor add-on plugin.
Technical details
Mitigation steps:
Affected products:
WordPress
King Addons for Elementor
Elementor
Related links:
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.