CVE-2025-62889: 
WordPress vulnerability analysis and mitigation

CVE-2025-62889 is a Missing Authorization (Broken Access Control) vulnerability in the King Addons for Elementor WordPress plugin by KingAddons.com. It allows authenticated attackers with low privileges (Contributor-level or higher) to exploit incorrectly configured access control security levels, potentially accessing restricted functionality. The vulnerability affects all plugin versions up to and including 51.1.62, with version 51.1.63 being the patched release. It carries a CVSS v3.1 base score of 6.5 (Medium), was reported on July 19, 2025, and publicly disclosed on August 18, 2025 (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to properly verify whether the requesting user has the necessary permissions before executing privileged actions. This is consistent with a missing or improperly implemented authorization check — such as the absence of a capability check or nonce validation — on a WordPress AJAX handler or REST API endpoint exposed by the plugin. Exploitation requires network access and a low-privilege authenticated account (Contributor or Developer role), with no user interaction needed (Patchstack, Red Hat CVE).

Successful exploitation allows a low-privileged authenticated user to perform actions that should be restricted to higher-privileged roles, resulting in a high confidentiality impact with no integrity or availability impact per the CVSS scoring. This could expose sensitive site data or configuration information accessible only to administrators or editors. The scope is limited to the affected WordPress installation, with no direct lateral movement capability, though exposed data could facilitate further attacks (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites, this specific issue is assessed as low priority with unlikely exploitation impact (Patchstack).

The vendor has released a patched version of the King Addons for Elementor plugin. Site administrators should update to version 51.1.63 or later immediately. If an immediate update is not possible, restricting Contributor-level user registration or limiting untrusted user roles on the WordPress site can reduce exposure. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and reported by security researcher Abu Hurayra through Patchstack's Vulnerability Disclosure Program (VDP) on July 19, 2025, and publicly disclosed on August 18, 2025. Patchstack classified it as low priority with no impactful threat, and no significant broader media coverage or notable community discussion has been identified (Patchstack).