External risk intelligence

KingAddons for Elementor Privilege Escalation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-6325

The vulnerability affects a WordPress plugin, which is a component of a web application. WordPress sites are typically deployed as public-facing web services, making the plugin's functionality and its management interfaces highly likely to be reachable via the internet in common deployment patterns.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the King Addons for Elementor plugin, a component used on WordPress websites. It allows unauthorized users to gain elevated privileges within the system. The main concern is to determine if this plugin is in use and assess potential exposure.

Plugin allows unauthorized privilege escalation.
Leadership should remember its potential for unauthorized access.
Confirm relevance and exposure of the affected plugin.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by reaching a feature within the King Addons for Elementor plugin that incorrectly assigns privileges. This could allow an unauthenticated attacker to escalate their privileges on the affected system.

No authentication required for entry.
Triggered by interacting with a vulnerable plugin feature.
Allows an attacker to gain higher access levels.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to escalate their privileges within the King Addons for Elementor plugin. This might lead to unauthorized modification of plugin settings or other sensitive actions, depending on the specific features and configurations of the affected WordPress site.

Plugin settings and related data.
Via network requests to the plugin.
Unauthorized administrative actions.

Operational Fix

Recommended remediation, mitigation, and detection steps

The King Addons for Elementor plugin, specifically versions up to and including 51.1.36, presents a critical privilege escalation vulnerability. This impacts web applications using this plugin, and initial triage should focus on identifying all instances, assessing their exposure, and confirming ownership. Application owners, in coordination with security and infrastructure teams, will likely manage remediation, prioritizing business-critical or internet-facing systems.

Application owners should manage the issue.
Verify plugin reachability and business criticality first.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is King Addons for Elementor?

King Addons for Elementor is a plugin used within the WordPress content management system to extend the functionality of the Elementor page builder. Users typically install it to add extra design elements or widgets to their websites. Like other WordPress plugins, it operates within the site's environment, processing requests and managing content features to help site administrators build and customize their web pages.

What does CWE-266 mean for CVE-2025-6325?

CWE-266 is the weakness class for Incorrect Privilege Assignment. In the context of CVE-2025-6325, it means the plugin has a logic flaw that handles user permissions incorrectly. Instead of enforcing strict rules, the code may mistakenly grant elevated rights—such as administrative access—to a user who should not have them. This allows an unauthorized person to act with higher permissions than the system intended to provide.

How is this vulnerability triggered?

An attacker triggers this by interacting with specific, vulnerable features within the plugin via network requests. It does not require the attacker to have an existing account or password to start the process. Notably, simply having the plugin installed does not trigger the bug; the attacker must intentionally send requests that hit the flawed code path where the privilege assignment occurs.

Is my site at risk if it uses this plugin?

According to Halo Surface Signal, this vulnerability is highly relevant because WordPress plugins are often part of public-facing web services. If your site is reachable via the internet, the plugin's features are likely accessible to external actors. You should consider any internet-facing installation a potential entry point for unauthorized privilege escalation, regardless of how often you use the plugin's specific widgets.

What should I do if I run King Addons for Elementor?

First, verify if you are using a version up to and including 51.1.36, as these are the affected versions. Identify where the plugin is deployed in your environment, focusing on systems that are critical to your business or exposed to the internet. Coordinate with your team to track the plugin's usage and prioritize these systems for security updates once they are available from the plugin developer.

References

patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.