Introduction
A privilege escalation flaw in King Addons for Elementor versions 24.12.92 through 51.1.14 lets unauthenticated users register as administrators. An attacker who exploits it gets full administrative access to the WordPress site, which means total site compromise. King Addons for Elementor is a widely used extension for the Elementor page builder, with over 10,000 active installations. It lets users add widgets, templates, and features to WordPress sites without writing code.
Technical Information
The flaw is in the plugin's user registration handler, specifically in how it processes the user_role parameter during account creation. The handler is exposed through an AJAX endpoint, and unauthenticated users can reach it when public registration is enabled. In affected versions, the code does not properly restrict which roles can be assigned at registration. It accepts any role value the client sends, including 'administrator'.
The vulnerable code pattern looks like this:
if (!empty($user_role) && $user_role !== 'subscriber') { $user_data['role'] = $user_role; } $user_id = wp_insert_user($user_data);
With this logic, a POST request to /wp-admin/admin-ajax.php with action=king_addons_user_register and user_role=administrator makes the plugin create a new administrator account. The attacker needs no authentication or special privileges. The only prerequisites are that public registration is enabled and the King Addons registration form is active on the site.
The patched version (51.1.37) adds an allowlist that limits registration to the 'subscriber' and 'customer' roles only.
Affected Systems and Versions
- King Addons for Elementor plugin for WordPress
- Versions 24.12.92 through 51.1.14 are vulnerable
- The vulnerability is present when public registration is enabled and the King Addons registration form is active
Vendor Security History
KingAddons.com has had multiple critical vulnerabilities in 2025, including privilege escalation and arbitrary file upload flaws in this same plugin. The fix for CVE-2025-8489 took approximately 47 days from initial disclosure to release. The vendor's history shows recurring problems with input validation and privilege management, which suggests limited security maturity in its development practices.
