External risk intelligence

King Addons for Elementor Unrestricted File Upload Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-6327

This vulnerability affects a WordPress plugin designed to extend website functionality. WordPress plugins are typically deployed on internet-facing web servers to render content to the public, making the upload interface and the web server itself commonly accessible via the internet as part of normal operation.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in a WordPress plugin used for website customization, allowing unauthorized users to upload malicious files to a web server. This could potentially compromise the integrity and availability of online services.

Malicious file uploads to web servers.
Affects public-facing website customization.
Confirm relevance and identify exposure.

Attack Path

How an attacker could exploit the issue

An attacker could upload a dangerous file, such as a web shell, to a web server by exploiting an unrestricted file upload vulnerability in a WordPress plugin. This could allow them to execute arbitrary code on the server, potentially leading to a complete compromise of the website and its data.

No authentication is required.
An attacker uploads a malicious file.
Results in server compromise and code execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the King Addons for Elementor plugin could allow an unauthenticated attacker to upload a web shell to the web server when the plugin is installed. This could potentially impact the integrity and availability of the affected website.

Web server files could be compromised.
A web shell could be uploaded over the network.
Website integrity and availability may be impacted.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in a WordPress plugin, which allows for the upload of web shells, likely affects organizations using the King Addons for Elementor plugin on their websites. Initial actions should focus on identifying all instances of this plugin, assessing their internet reachability and business criticality, and locating the accountable system or application owner to plan a risk-based remediation.

Plugin owners and web administrators should own this.
Verify plugin usage and external exposure.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is King Addons for Elementor?

King Addons for Elementor is a WordPress plugin used to extend website customization capabilities. Plugins like this are installed on web servers to add functional elements to a site's interface, allowing administrators to modify or enhance their pages beyond the core Elementor framework.

What does CWE-434 mean for CVE-2025-6327?

CWE-434 refers to an Unrestricted Upload of File with Dangerous Type. In the context of CVE-2025-6327, this means the plugin fails to properly validate the files users attempt to upload. Because of this weakness, an attacker can upload scripts that the server might execute, such as a web shell, which grants them unauthorized control over the server environment.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specifically crafted file to the web server through the plugin. Crucially, the vulnerability does not require the attacker to have an existing account or password for the website. It is an unauthenticated process, meaning any remote user can attempt the upload without needing to be logged into the site's administrative dashboard.

Is my website at risk from this vulnerability?

According to Halo Surface Signal, this plugin is designed to render content for the public, which often results in the affected upload interfaces being internet-facing. If your website uses this plugin and is accessible to the public, the path for an attacker to reach and exploit this vulnerability is commonly present due to the nature of WordPress web services.

How do I respond to CVE-2025-6327?

Your first step is to audit your environment to confirm if King Addons for Elementor is installed. If you find the plugin, identify who manages the website and determine its role in your operations. Focus on verifying if the site is internet-facing and coordinate with your technical team to prioritize removing or replacing the plugin until a secure version is confirmed available by the vendor.

References

patchstack.com/database/Wordpress/Plugin/king-addons/vulnerability/w…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.