What’s Vulnerable › Vulnerabilities

CVE-2025-11168: Mementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-11 · updated 2026-10-18
• Weakness: CWE-269

Description

The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality.

Affected products

• mvirik Mementor Core: through 2.2.5

References

• http://plugins.trac.wordpress.org/browser/mementor-core/trunk/inc/functions.php#L1033
• https://wordpress.org/plugins/mementor-core/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2460e7c4-76dc-4bc3-bc06-b52df64f5353?source=cve

Get alerted when CVE-2025-11168 or the next vulnerability affects your stack