CVE-2025-11168: Mementor Core Privilege Escalation Flaw

CVE-2025-11168 Overview

CVE-2025-11168 is a privilege escalation vulnerability in the Mementor Core plugin for WordPress affecting all versions up to and including 2.2.5. The flaw resides in the plugin's user switch back functionality, which fails to properly validate the identity of the user invoking it. Authenticated attackers with Subscriber-level access or above can abuse this functionality to switch into an administrator account. Successful exploitation grants attackers full administrative control over the WordPress site, including the ability to install plugins, modify content, and access stored data. The vulnerability is categorized under [CWE-269] Improper Privilege Management.

Critical Impact
A Subscriber-level account can be escalated to a full WordPress administrator through the unprotected switch back function, leading to complete site takeover.

Affected Products

Mementor Core plugin for WordPress (all versions ≤ 2.2.5)
WordPress sites with the Mementor Core plugin installed and activated
Any WordPress installation allowing Subscriber-level registrations alongside the vulnerable plugin

Discovery Timeline

2025-11-11 - CVE-2025-11168 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11168

Vulnerability Analysis

The Mementor Core plugin implements a user switching feature that allows administrators to impersonate other users and then switch back to their original account. The vulnerability stems from missing authorization checks on the switch back routine. When the plugin processes the switch back request, it does not verify that the current session was previously originated by an administrator. Any authenticated user can call the function and be returned to whatever account is stored as the switch back target, which in many environments is an administrator account.

This results in vertical privilege escalation from any low-privileged role to administrator without requiring credentials, tokens, or user interaction beyond a single authenticated request.

Root Cause

The root cause is improper privilege management [CWE-269] in the user switch back handler defined in inc/functions.php of the plugin. The handler accepts the switch back request based on session state alone and lacks a capability check such as current_user_can() to confirm that the requester is an administrator or that they had previously initiated an admin-to-user switch. Without this validation, the plugin trusts any authenticated request to perform the privileged switch.

Attack Vector

Exploitation requires only an authenticated session at Subscriber level or higher, which on many WordPress sites is obtainable through self-registration. The attacker sends an HTTP request to the plugin endpoint that triggers the switch back function. The plugin then re-authenticates the requester as the administrator account configured for switch back, dropping a valid administrator session cookie. The attack vector is network-based, requires no user interaction, and can be executed with a single request.

No verified public proof-of-concept code is available. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for technical specifics.

Detection Methods for CVE-2025-11168

Indicators of Compromise

Unexpected administrator-level activity originating from accounts that were created with Subscriber, Contributor, or Author roles.
WordPress audit log entries showing role changes, plugin installations, or theme edits performed by previously low-privileged users.
Authentication cookies for administrator accounts being issued to sessions that previously held a lower-privileged role.
New administrator accounts or modified user capabilities following requests to Mementor Core switch endpoints.

Detection Strategies

Monitor HTTP requests to Mementor Core plugin endpoints, particularly those associated with the switch and switch back functions in inc/functions.php.
Correlate session identifiers across role transitions to detect a single session moving from Subscriber to Administrator without a legitimate admin login.
Enable a WordPress activity logging plugin and alert on user_switched or equivalent events tied to non-admin originators.

Monitoring Recommendations

Track creation of administrator accounts and changes to the wp_capabilities user meta field.
Review web server access logs for repeated requests to Mementor Core endpoints from authenticated low-privileged users.
Alert on installation of new plugins or themes by users whose primary role is not administrator.

How to Mitigate CVE-2025-11168

Immediate Actions Required

Update the Mementor Core plugin to a version newer than 2.2.5 once the vendor releases a fix, or deactivate and remove the plugin until a patch is available.
Audit all WordPress user accounts and remove any unexpected administrator accounts or capability changes.
Force a password reset and invalidate active sessions for all administrator accounts on affected sites.
Disable open user registration if it is not required by the site.

Patch Information

At the time of publication, the Wordfence Vulnerability Report and the WordPress Plugin Overview should be monitored for an official patched release. Administrators should apply the fixed version as soon as the vendor publishes it.

Workarounds

Deactivate the Mementor Core plugin until a patched version is released.
Restrict access to the plugin's switch endpoints using a web application firewall rule that blocks requests from non-administrator users.
Limit the default role for new registrations or disable self-registration entirely via the WordPress General settings.
Apply the principle of least privilege by reviewing and reducing user roles where elevated permissions are not required.

bash

# Disable the vulnerable plugin via WP-CLI until a patch is available
wp plugin deactivate mementor-core
wp plugin status mementor-core

# Disable open user registration
wp option update users_can_register 0

# Set default new-user role to subscriber (lowest privilege)
wp option update default_role subscriber