PT-2025-46244 · WordPress · Mementor Core

Youcef Hamdani · Published 2025-11-11 · Updated 2025-11-16 · CVE-2025-11168

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mementor Core plugin for WordPress versions up to and including 2.2.5

Description The plugin does not properly handle the user switch back function, allowing authenticated attackers with Subscriber-level access or above to elevate their privileges and access an administrator account through the switch back functionality. This results in a privilege escalation flaw where users can impersonate an administrator.

Recommendations Update Mementor Core plugin to a version later than 2.2.5.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-11168

Affected Products

Mementor Core

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-11168 · Security Note
• https://twitter.com/cracbot/status/1990012011250594062 · Twitter Post
• https://wordpress.org/plugins/mementor-core · Note
• https://t.me/cveNotify/142362 · Telegram Post
• https://twitter.com/MNovofastovsky/status/1989643487973900578 · Twitter Post
• https://twitter.com/CveTodo/status/1988103994544148836 · Twitter Post
• https://twitter.com/AnonOzzyDude/status/1988159397831315786 · Twitter Post
• http://plugins.trac.wordpress.org/browser/mementor-core/trunk/inc/functions.php#L1033 · Note
• https://twitter.com/CVEnew/status/1988095344190668862 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2460e7c4-76dc-4bc3-bc06-b52df64f5353?source=cve · Note