WordPress King Addons Flaw Under Active Attack Lets Hackers Make Admin Accounts

A critical security flaw (CVE-2025-8489) in the WordPress King Addons for Elementor plugin is under active exploitation. The vulnerability has a CVSS score of 9.8 and allows unauthenticated attackers to grant themselves administrative privileges by specifying the administrator user role during registration. This privilege escalation flaw enables attackers to create admin accounts without authentication, posing a significant threat to WordPress sites using the affected plugin.