CVE-2025-13618CWE-269privilege-escalation

CVE-2025-13618

Critical · published May 5, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
25.8
In the wild
Unconfirmed
What it is

The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the roles that users can register with in the mentoring_process_registration() function. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.8th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-05-05T07:15Z
References (3)
https://mentoring-wp.dreamsmarketplace.com/documentation/changelog.html · [email protected]https://themeforest.net/item/mentoring-education-wordpress-theme/36457081 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/7192fb4c-0434-4e11-a2a7-c205b8d6b68e?source=cve · [email protected]
EPSS history
Timeline
  • 05 MAY 02:26Z
    Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration
    cvelistv5