PT-2026-36948 · WordPress · Mentoring Plugin

Ismail Syaleh · Published 2026-05-05 · Updated 2026-05-16 · CVE-2025-13618

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mentoring plugin for WordPress versions prior to 1.2.9

Description The plugin allows privilege escalation because the mentoring process registration() function does not properly restrict the roles users can select during registration. This flaw enables unauthenticated attackers to create accounts with administrator-level privileges.

Recommendations Update the plugin to a version later than 1.2.8. As a temporary workaround, restrict access to the registration functionality associated with the mentoring process registration() function.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13618

Affected Products

Mentoring Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13618 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7192fb4c-0434-4e11-a2a7-c205b8d6b68e?source=cve · Note
• https://themeforest.net/item/mentoring-education-wordpress-theme/36457081 · Note
• https://i.redd.it/xjz0k7uzz51h1.png · Reddit Post
• https://twitter.com/CVEarity/status/2051567757460996570 · Twitter Post
• https://twitter.com/ADKCyber/status/2055697943525540031 · Twitter Post
• https://mentoring-wp.dreamsmarketplace.com/documentation/changelog.html · Note
• https://t.me/cveNotify/162123 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051623799972336032 · Twitter Post
• https://twitter.com/OrizonCyber/status/2051527331601080686 · Twitter Post