Two (2) actively exploited critical vulnerabilities in widely used WordPress plugins are enabling attackers to take over full administrative control of vulnerable websites and, in some cases, execute arbitrary code. The most heavily abused flaw, tracked as CVE-2025-8489 (CVSS 9.8/10), affects King Addons for Elementor, a third-party extension for WordPress, and allows unauthenticated attackers to escalate privileges by assigning themselves the administrator role during user registration via maliciously crafted admin-ajax.php requests. The vulnerability impacts versions 24.12.92 through 51.1.14 and was patched in version 51.1.35 on September 25, 2025, yet exploitation began almost immediately after public disclosure on October 31 and surged into mass attacks by November 9. According to Wordfence of Defiant, more than 48,400 exploitation attempts have been blocked, with activity concentrated among a small set of highly aggressive IPs. Successful exploitation allows attackers to create rogue admin accounts, upload malicious code, redirect visitors, inject spam, or deploy persistent malware. Compounding the risk, Wordfence has also warned of CVE-2025-13486, a separate critical unauthenticated remote code execution (RCE) flaw in Advanced Custom Fields: Extended, which affects over 100,000 sites and can be used to deploy backdoors or create administrator accounts. CTIX analysts strongly advise Website owners to immediately update affected plugins, audit environments for unauthorized admin users, review logs for exploitation attempts, and closely monitor for anomalous activity as public disclosure continues to drive attacker interest.