Critical Flaws in Elementor King Addons Affect 10,000 WordPress Sites
King Addons for Elementor plugin (10,000+ sites) has two critical unauthenticated vulnerabilities enabling full site takeover. CVE-2025-6327: arbitrary file upload via exposed AJAX handler—attackers can upload web shells because the nonce is leaked to all visitors via localized script data and validation fails (file_validity() returns non-empty string instead of false). CVE-2025-6325: privilege escalation via registration endpoint accepting client-supplied roles—POST user_role=administrator creates admin accounts when site registration is enabled. What's nasty: both require zero authentication and are trivially exploitable. Patchstack analyzed the code showing how allowed_file_types can be manipulated and uploads land in web-accessible directories.
CORTEX Protocol Intelligence Assessment
Classic plugin security failures: trusting client input for authorization decisions and exposing privileged operations without authentication. The nonce leak demonstrates why security-by-obscurity fails—once the 'secret' nonce is in page source, it's game over. The registration flaw shows improper role validation letting attackers directly specify their privilege level.
Strategic Intelligence Guidance
- Immediate patching: update to version 51.1.37 which adds role allowlist restricting new accounts to subscriber/customer and enforces upload_files permission.
- Audit all WordPress sites for King Addons Login/Register Form widget usage—disable if not actively needed.
- General WordPress hardening: disable site registration unless required, implement allowlist-based role assignment, validate all file uploads server-side.
- Monitor for indicators: new admin account creation, files uploaded to wp-content/uploads/king-addons/forms/, or suspicious AJAX requests to king_addons_user_register.
CVEs
Vendors
Targets
Impact
Financial:10,000+
Intelligence Source: Critical Flaws Found in Elementor King Addons Affect 10,000 Sites | Oct 31, 2025