King Addons CVE-2025-8489

Exploitation requires the target WordPress site to deploy the King Addons for Elementor Login/Register Form widget (the vulnerable Login_Register_Form_Ajax.php handler) with user registration functionality exposed, on a plugin version between 24.12.92 and 51.1.14. Where that registration widget is active, there are no further limiting factors - the CVSS PR:N/UI:N confirms an unauthenticated remote attacker needs no credentials, no user interaction, and no non-default account privileges; they simply supply an elevated role value the plugin fails to restrict. The principal limit on real-world exploitation is therefore whether a given site actually publishes the plugin's registration form rather than relying on core WordPress registration.

All severity signals point the same direction and are internally consistent: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no privileges or user interaction, and the C:H/I:H/A:H impacts yield a 9.8 Critical base score that matches the described outcome - an unauthenticated attacker self-registering a full administrator account, which is effectively total site compromise. This is a genuine high-priority issue rather than an inflated-CVSS one, because the primitive (choosing your own role at registration) is trivially weaponizable and grants the highest-value WordPress privilege directly. That said, several exploitation-probability signals are absent: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is currently no public exploit identified at time of analysis and no evidence of active or widespread exploitation. The key limiting factor not captured by the network-vector score is configuration-dependence - the vulnerable AJAX endpoint lives in the plugin's Login/Register Form widget, so a site must actually deploy and enable that registration widget to be exploitable, which the CVSS AC:L does not reflect.

An attacker browses to a WordPress site running a vulnerable King Addons for Elementor version (24.12.92-51.1.14) that exposes the plugin's Login/Register Form widget, then submits a crafted registration request to the Login_Register_Form_Ajax endpoint specifying an administrator role, which the plugin fails to restrict. The attacker's new account is created with administrator privileges, granting full control of the site. No public exploit code was identified in the provided data, but the technique is simple and does not require authentication or user interaction.