johenlastgen-jlg/cve-2025-6325_cve-2025-6327Python PoC validating CVE-2025-6325 unauthenticated privilege escalation and CVE-2025-6327 arbitrary file upload RCE in King Addons for Elementor <= 51.1.36.
Research and validation tool for King Addons for Elementor <= 51.1.36, covering two documented vulnerabilities:
For authorized security testing, vulnerability research, and controlled lab environments only.
This project provides a dual-purpose PoC for validating the security impact of two vulnerabilities in King Addons for Elementor.
Unauthenticated privilege escalation through the King Addons registration functionality.
The vulnerable flow accepts a client-controlled user_role value and passes it to WordPress user creation without enforcing an appropriate role allowlist.
Affected version: <= 51.1.36
Patched version: 51.1.37
The vulnerable registration flow uses:
POST /wp-admin/admin-ajax.php
action=king_addons_user_register
user_role=administrator
The PoC also verifies whether the created account can authenticate and access the WordPress users administration page.
Unauthenticated arbitrary file upload through the King Addons form builder upload functionality.
The vulnerable upload handler can incorrectly accept a PHP file, resulting in a web-accessible uploaded file and potential server-side code execution.
Affected version: <= 51.1.36
Patched version: 51.1.37
The relevant AJAX action is:
POST /wp-admin/admin-ajax.php
action=king_addons_upload_file
The PoC validates the upload flow and checks whether the uploaded test file can execute a benign id command.
The script supports four operation modes:
check
privesc
upload
both
These modes are exposed directly by the command-line interface.
Python 3 is required.
No third-party Python packages are required.
Check your Python version:
python3 --version
Run both vulnerability checks:
python3 exploit.py -u http://target.local --exploit both
Discover exposed King Addons nonces without running the exploit stages:
python3 exploit.py -u http://target.local --exploit check
python3 exploit.py -u http://target.local --exploit privesc
python3 exploit.py -u http://target.local --exploit upload
Create a target file:
http://target1.local
https://target2.local
http://target3.local
Comments and empty lines are ignored.
Run a passive assessment:
python3 exploit.py -l targets.txt --exploit check
Run both validation stages:
python3 exploit.py -l targets.txt --exploit both -t 20
Run upload validation:
python3 exploit.py -l targets.txt --exploit upload -t 20
Run privilege-escalation validation:
python3 exploit.py -l targets.txt --exploit privesc -t 20
The PoC automatically searches target pages for the nonces required by the two vulnerable flows.
Default crawler settings:
Depth : 3
Max pages : 80
Timeout : 20 seconds
Threads : 10
These defaults are defined in the script's CLI configuration.
Example:
python3 exploit.py \
-l targets.txt \
--exploit both \
-t 20 \
--depth 3 \
--max-pages 80 \
--timeout 20
The script defaults to results.tsv for structured results and loot.txt for successful validation entries.
During execution, the tool reports several states.
Indicates that the upload validation succeeded and the test PHP file responded to the verification request.
Example:
PWNED [SHELL]
Indicates that the privilege-escalation validation created an account using the vulnerable registration flow.
The tool additionally records whether the account was verified against the WordPress users administration page.
The created account was successfully authenticated and confirmed on the WordPress users page.
The registration request succeeded, but the subsequent verification step could not confirm the resulting account.
No successful validation result was obtained.
The target produced a network, parsing, crawling, or other execution error.
Structured results are written as TSV:
results.tsv
The output contains fields for:
target
status
shell_url
shell_rce
priv_user
priv_pwd
priv_verified
err
This format is useful for importing results into spreadsheets or further processing.
Successful validation entries are additionally written to:
loot.txt
The script writes shell and privilege-validation results as separate entries.
Visitor
│
▼
Public King Addons Register Form
│
▼
Nonce discovery
│
▼
king_addons_user_register
│
▼
Client-controlled user_role
│
▼
WordPress user creation
│
▼
Privilege escalation validation
The PoC specifically submits:
user_role=administrator
to the registration endpoint.
Visitor
│
▼
King Addons Form Builder
│
▼
Upload nonce discovery
│
▼
king_addons_upload_file
│
▼
PHP test file upload
│
▼
Uploaded file URL
│
▼
Benign execution verification
The PoC uses a uniquely generated test filename and checks the returned upload URL.
The research implementation was tested against:
WordPress 6.8 / 7.1
Elementor 4.2.3
King Addons 51.1.14
The research notes report successful validation of both flows in a controlled lab environment, including privilege escalation and shell execution. A negative control was also tested against version 51.1.37.
The research notes indicate that some WordPress.org ZIP releases for 51.1.35 and 51.1.36 were subsequently retagged with partial fixes.
The vulnerable implementation was therefore confirmed using the referenced SVN tag 51.1.14.
If reproducing the research, use the exact lab version and package identified by the research rather than assuming every package labeled 51.1.35 or 51.1.36 contains identical vulnerable code.
This project is intended for:
Only test systems for which you have explicit authorization.
Do not use this project against third-party infrastructure without permission.
The author does not encourage unauthorized access, persistence, data theft, or disruption of systems.
This software is provided for security research and authorized testing purposes.
You are responsible for ensuring that your use of this project complies with applicable laws, regulations, contracts, and authorization requirements.
The author and contributors assume no responsibility for misuse, damage, service disruption, data loss, or other consequences resulting from unauthorized use.
JohenLastGen — JLG NETWORK
Research & Security Tooling
Telegram:
@johenlastgen
Channel:
@jlgnetworkredirect
MIT License
See LICENSE for the full license text.
| Option | Description |
|---|
-u, --url | Test a single target URL |
-l, --list | File containing target URLs |
-e, --exploit | Select check, privesc, upload, or both |
-t, --threads | Number of concurrent workers |
--depth | Maximum crawler link depth |
--max-pages | Maximum pages crawled per target |
--timeout | HTTP request timeout in seconds |
-o, --output | TSV results output |
--loot | Successful validation output |
--no-color | Disable terminal colors |