CVE-2025-13618 - Vulnerability Analysis

Overview

WordPress Mentoring plugin <= 1.2.8 contains a privilege escalation caused by improper role restriction in mentoring_process_registration() function, letting unauthenticated attackers register as administrators, exploit requires unauthenticated access.

Severity & Score

Impact

Unauthenticated attackers can register as administrators, gaining full control over the WordPress site.

Mitigation

Update to a version later than 1.2.8 or the latest available version.

References

• https://mentoring-wp.dreamsmarketplace.com/documentation/changelog.html
• https://themeforest.net/item/mentoring-education-wordpress-theme/36457081
• https://www.wordfence.com/threat-intel/vulnerabilities/id/7192fb4c-0434-4e11-a2a7-c205b8d6b68e?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner