{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/products/mentoring-plugin-for-wordpress/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2025-13618"}],"_cs_exploited":false,"_cs_products":["Mentoring plugin for WordPress"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","wordpress","plugin"],"_cs_type":"advisory","_cs_vendors":["Wordpress"],"content_html":"\u003cp\u003eThe Mentoring plugin for WordPress, versions 1.2.8 and earlier, contains a critical vulnerability (CVE-2025-13618) that allows unauthenticated attackers to escalate privileges. This flaw resides in the \u003ccode\u003ementoring_process_registration()\u003c/code\u003e function, which fails to properly restrict the roles that new users can register with. By exploiting this vulnerability, an attacker can bypass authentication and directly create administrator accounts, granting them full control over the affected WordPress site. This vulnerability was reported by Wordfence.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn unauthenticated attacker identifies a WordPress site using the vulnerable Mentoring plugin (version \u0026lt;= 1.2.8).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request targeting the registration endpoint associated with the \u003ccode\u003ementoring_process_registration()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eThe crafted request includes parameters designed to register a new user account with administrator privileges.\u003c/li\u003e\n\u003cli\u003eDue to the insufficient role validation within the \u003ccode\u003ementoring_process_registration()\u003c/code\u003e function, the plugin allows the attacker to specify the \u0026lsquo;administrator\u0026rsquo; role during registration.\u003c/li\u003e\n\u003cli\u003eThe plugin creates a new user account in the WordPress database with the specified administrator role.\u003c/li\u003e\n\u003cli\u003eThe attacker logs into the WordPress site using the newly created administrator account.\u003c/li\u003e\n\u003cli\u003eThe attacker gains full control over the WordPress site, including the ability to modify content, install plugins, and manage user accounts.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability grants unauthenticated attackers complete administrative control over the affected WordPress website. This can lead to a range of malicious activities, including defacement, data theft, installation of malware, and denial of service. The impact is significant due to the ease of exploitation and the potential for widespread compromise of websites using the vulnerable plugin.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Mentoring plugin for WordPress to the latest version (greater than 1.2.8) to patch CVE-2025-13618.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect WordPress Mentoring Plugin Admin Registration\u003c/code\u003e to identify potential exploitation attempts targeting the \u003ccode\u003ementoring_process_registration()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eMonitor WordPress access logs for suspicious registration attempts targeting the vulnerable plugin.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-05-05T03:15:58Z","date_published":"2026-05-05T03:15:58Z","id":"/briefs/2026-05-wordpress-mentoring-privesc/","summary":"The Mentoring plugin for WordPress is vulnerable to privilege escalation, allowing unauthenticated attackers to register with administrator-level user accounts due to improper role restriction in the mentoring_process_registration() function.","title":"WordPress Mentoring Plugin Privilege Escalation Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-05-wordpress-mentoring-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed — Mentoring Plugin for WordPress","version":"https://jsonfeed.org/version/1.1"}