PT-2026-36948 · Dreamstechnologies · Mentoring

Ismail Syaleh · Published 2026-05-05 · Updated 2026-05-05 · CVE-2025-13618

Mitre

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Mentoring plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.2.8. This is due to the plugin not properly restricting the roles that users can register with in the mentoring process registration() function. This makes it possible for unauthenticated attackers to register with administrator-level user accounts.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13618

Affected Products

Mentoring

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-13618 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/7192fb4c-0434-4e11-a2a7-c205b8d6b68e?source=cve · Note
• https://mentoring-wp.dreamsmarketplace.com/documentation/changelog.html · Note
• https://themeforest.net/item/mentoring-education-wordpress-theme/36457081 · Note