CVE-2025-6325CWE-266

CVE-2025-6325

Critical · published November 6, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
34.6
In the wild
Unconfirmed
What it is

🚨 An incorrect privilege assignment in King Addons for Elementor lets attackers elevate their access—think of it as a hotel guest with a master key! 🔥 Imagine checking into a hotel and accidentally receiving the master key to every room. This vulnerability allows unauthorized guests to waltz into restricted areas, snooping around and potentially causing havoc. With this vulnerability, an attacker could gain elevated privileges, enabling them to modify settings, access sensitive data, or even take full control of your site. The worst part? This kind of privilege escalation can lead to catastrophic data breaches that compromise user trust and security.

Put simply

Imagine checking into a hotel and accidentally receiving the master key to every room. This vulnerability allows unauthorized guests to waltz into restricted areas, snooping around and potentially causing havoc. This incorrect privilege assignment vulnerability in King Addons for Elementor allows users with lower privileges to escalate their access rights, resulting in unauthorized actions across the platform.

What to do

With this vulnerability, an attacker could gain elevated privileges, enabling them to modify settings, access sensitive data, or even take full control of your site. The worst part? This kind of privilege escalation can lead to catastrophic data breaches that compromise user trust and security. Immediate patching is essential! Update King Addons for Elementor to version 51.1.37 or later to close this critical gap. Additionally, review your user roles and permissions to ensure proper access controls are in place. You've got this! Take these steps now to secure your site, and you'll be a security hero in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00414 · 34.6th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-11-06T21:16Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:56Z
    WordPress King Addons for Elementor plugin <= 51.1.36 - Privilege Escalation vulnerability
    cvelistv5