CVE-2025-6327 CRITICAL

CVE-2025-6327: WordPress King Addons for Elementor plugin <= 51.1.36 - Arbitrary File Upload vulnerability

Vendor Kingaddons.com
Product King Addons for Elementor
Weakness CWE-434 · Unrestricted file upload
Published November 6, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server.This issue affects King Addons for Elementor: from n/a through <= 51.1.36.

Explanation of Vulnerability in Simple Terms

02Summary

King Addons for Elementor versions up to 51.1.36 allow unauthenticated attackers to upload arbitrary files to the site without restriction. An attacker can upload malicious files (such as PHP scripts) directly over the network, potentially gaining full control of the site. No user interaction or special privileges are required.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files to the site and execute malicious code without authentication.

Potential impact on your site

04Site Impact

Complete site compromise: attackers can run code, steal data, modify content, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access only; no authentication, user interaction, or special privileges required.

Key dates

06Disclosure timeline

November 6, 2025 CVE published
April 28, 2026 Record updated