CampaignPublished 3 Dec 2025

WordPress King Addons Flaw Under Active Attack Lets Hackers Make Admin Accounts

Source Reddit InfoSec News

Description

A critical vulnerability in the WordPress King Addons plugin is actively exploited in the wild, allowing attackers to create unauthorized administrator accounts. This flaw enables privilege escalation without requiring prior authentication or user interaction, posing a significant risk to affected WordPress sites. Exploitation can lead to full site compromise, data theft, and potential use of the site for further malicious activities. The vulnerability is currently under active attack, emphasizing the urgency for site administrators to take immediate protective measures. No official patches or CVEs have been published yet, increasing the risk window. European organizations using this plugin are at heightened risk, especially those with high-value web assets. Mitigation requires immediate plugin updates once available, restricting access to WordPress admin areas, and monitoring for suspicious account creations. Countries with large WordPress user bases and significant e-commerce or media sectors are most likely to be targeted. Given the ease of exploitation and impact, the threat severity is assessed as critical. Defenders must prioritize detection and response to prevent full administrative takeover of their WordPress environments.

Impact

For European organizations, this vulnerability poses a significant threat to the confidentiality, integrity, and availability of their web assets. Compromise of WordPress sites can lead to data breaches involving customer information, intellectual property theft, and disruption of online services. Organizations in sectors such as e-commerce, media, government, and education that rely heavily on WordPress for their web presence are particularly vulnerable. The creation of unauthorized admin accounts enables attackers to fully control the site, potentially defacing content, injecting malicious code, or using the site to distribute malware or conduct phishing campaigns targeting European users. The reputational damage and regulatory consequences under GDPR for data breaches could be severe. Additionally, the ease of exploitation without authentication or user interaction means that attackers can rapidly compromise multiple sites, increasing the scale and speed of potential attacks across Europe.

Defensive guidance

European organizations should immediately audit their WordPress installations to identify the presence of the King Addons plugin and assess exposure. Until an official patch is released, administrators should restrict access to the WordPress admin dashboard by IP whitelisting or VPN-only access to reduce attack surface. Implementing multi-factor authentication (MFA) for all admin accounts can help mitigate the risk of unauthorized access. Monitoring logs for unusual account creation or privilege escalation events is critical for early detection. Employing web application firewalls (WAFs) with custom rules to block suspicious requests targeting the plugin endpoints can provide temporary protection. Regular backups of WordPress sites and databases should be maintained to enable rapid recovery in case of compromise. Organizations should subscribe to threat intelligence feeds and vendor advisories to apply patches promptly once available. Additionally, conducting a thorough security review of all installed plugins and removing unnecessary or outdated ones reduces overall risk.

Summary

The WordPress King Addons plugin contains a severe security flaw that is currently being exploited in active attack campaigns. This vulnerability allows attackers to create new administrator accounts on affected WordPress sites without requiring authentication or user interaction, effectively granting them full control over the website. The flaw likely stems from improper access control or input validation within the plugin's code, enabling privilege escalation. Although specific technical details such as the exact vulnerability type or affected plugin versions are not disclosed, the impact is critical due to the ability to bypass authentication and gain administrative privileges. The absence of official patches or CVE identifiers indicates that the vulnerability is newly discovered and under active exploitation, increasing the risk for unpatched sites. Attackers can leverage the newly created admin accounts to manipulate website content, steal sensitive data, deploy malware, or use the compromised site as a launchpad for further attacks. The threat is amplified by the widespread use of WordPress across various sectors, including European organizations. The lack of detailed technical indicators or exploit code in the public domain suggests that defenders must rely on monitoring unusual admin account creations and applying best security practices until an official patch is released.

References

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Dec 2025, 20:00 UTC

Technical details

References

Community reviews

Related threats