CVE-2025-13618: WordPress Mentoring Plugin Critical Privilege Escalation

Executive Summary

A critical privilege escalation vulnerability (CVE-2025-13618) has been discovered in the Mentoring plugin for WordPress, affecting all versions up to and including 1.2.8. The flaw carries a CVSS score of 9.8 — the highest possible severity tier.

The vulnerability allows an unauthenticated attacker to register a new WordPress account with any user role, including administrator, simply by manipulating the registration request. The root cause is that the mentoring_process_registration() function fails to restrict which roles a registrant can self-assign during sign-up.

Any WordPress site running the Mentoring plugin version 1.2.8 or earlier with open user registration should be treated as actively at risk until patched or the plugin is disabled.

Vulnerability Overview

Affected Versions

Technical Analysis

Root Cause

The Mentoring plugin provides a mentoring program management platform for WordPress, allowing users to register as mentors or mentees. During the registration process, the mentoring_process_registration() function handles new account creation.

The critical flaw: the function does not validate or restrict the role parameter submitted in the registration form. An attacker can supply an arbitrary role — including administrator — and the plugin will honour that value, creating a WordPress account with full administrative privileges.

This is a classic mass assignment / role restriction failure in a self-registration flow.

Attack Flow

1. Attacker locates a WordPress site running Mentoring plugin <= 1.2.8
2. Attacker confirms open user registration is enabled (common on mentoring platforms)
3. Attacker crafts a registration POST request:
   - username: attacker_admin
   - email: attacker@example.com
   - password: [chosen password]
   - role: administrator   ← plugin accepts this without validation
4. Plugin calls mentoring_process_registration() — processes the role as supplied
5. WordPress account is created with administrator role
6. Attacker logs in with full site control

Exploitation Conditions

• Mentoring plugin version 1.2.8 or earlier must be installed and active
• The registration form must be accessible (typical for mentoring platforms by design)
• No authentication is required — this is a fully unauthenticated attack path
• The vulnerability is exploitable remotely with a single POST request

Impact Assessment

Immediate Remediation

Step 1: Update or Disable the Mentoring Plugin

Check the WordPress plugin repository or vendor site for a patched version beyond 1.2.8. If no patch is available:

# Deactivate via WP-CLI
wp plugin deactivate mentoring
 
# Verify deactivation
wp plugin status mentoring

Or navigate to WordPress Admin > Plugins > Installed Plugins and deactivate the Mentoring plugin.

Step 2: Audit for Unauthorized Admin Accounts

# List all administrator accounts — look for unexpected entries
wp user list --role=administrator --fields=user_login,user_email,user_registered
 
# Check recently registered accounts (last 7 days)
wp db query "SELECT user_login, user_email, user_registered FROM wp_users
  WHERE user_registered > DATE_SUB(NOW(), INTERVAL 7 DAY)
  ORDER BY user_registered DESC;"

Remove any administrator accounts that were not intentionally created.

Step 3: Harden WordPress Registration

If registration must remain open, disable it temporarily while patching:

1. Navigate to WordPress Admin > Settings > General
2. Uncheck "Anyone can register"
3. Set "New User Default Role" to Subscriber as a baseline

Step 4: Force Admin Password Rotation

# Rotate all admin passwords as a precaution
wp user list --role=administrator --format=ids | \
  xargs -I {} wp user update {} --user_pass="$(openssl rand -base64 24)"
 
# Regenerate WordPress security keys
wp config shuffle-salts
 
# Invalidate all active sessions
wp db query "DELETE FROM wp_usermeta WHERE meta_key = 'session_tokens';"

Detection Indicators

Post-Remediation Checklist

1. Update the Mentoring plugin to a patched version beyond 1.2.8
2. Deactivate the plugin entirely if no patch is available
3. Audit all administrator accounts and remove unauthorized entries
4. Disable open user registration until the patch is confirmed applied
5. Reset all admin passwords and regenerate WordPress secret keys
6. Invalidate all active sessions to force re-authentication
7. Scan wp-content/ for webshells, modified plugin files, or backdoors
8. Review access logs for evidence of prior exploitation attempts
9. Enable two-factor authentication on all administrator accounts
10. Deploy a WordPress WAF (Wordfence, Sucuri, Cloudflare) with hardening rules
11. Monitor user registrations — alert on any new accounts with elevated roles

References

• NVD — CVE-2025-13618
• Wordfence — WordPress Vulnerability Intelligence
• WordPress Plugin Directory — Mentoring