A high-severity privilege escalation vulnerability exists in the Mementor Core plugin for WordPress. This flaw could allow a low-privileged attacker to gain administrative control over an affected website. Successful exploitation could lead to complete system compromise, data theft, and website defacement.

The Mementor Core plugin for WordPress fails to properly implement authorization checks for certain functions. An authenticated attacker with low-level permissions, such as a subscriber, can exploit this weakness by sending a specially crafted request to the server. This allows the attacker to elevate their privileges to that of an administrator, granting them full control over the WordPress site.

This vulnerability is rated as High severity with a CVSS score of 8.8. A successful exploit would grant an attacker full administrative access to the affected WordPress website. This could lead to severe business consequences, including theft of sensitive customer data, website defacement causing reputational damage, installation of malware or backdoors for persistent access, and using the compromised website to launch further attacks like phishing campaigns. The potential for complete site takeover presents a significant risk to business operations, data integrity, and customer trust.

Immediate Action: Immediately update the Mementor Core plugin to the latest version provided by the vendor, which addresses this vulnerability. If the plugin is not essential for business operations, consider deactivating and removing it to eliminate the attack surface entirely.

Proactive Monitoring: Monitor WordPress audit logs for unexpected or unauthorized changes to user roles, particularly any elevation to an administrator role. Review web server access logs for suspicious POST requests to plugin-specific endpoints. Implement file integrity monitoring to detect unauthorized changes to core WordPress, plugin, or theme files.

Compensating Controls: If patching is not immediately possible, implement a Web Application Firewall (WAF) with rules designed to block common privilege escalation attempts. Restrict access to the WordPress admin dashboard (/wp-admin) to trusted IP addresses. Enforce the principle of least privilege for all user accounts and regularly audit user roles and permissions.

Public Exploit Available: false

Given the high severity (CVSS 8.8) of this vulnerability and the potential for complete website compromise, we strongly recommend that organizations prioritize applying the security update for the Mementor Core plugin immediately. Although this CVE is not currently on the CISA KEV list, the popularity of WordPress makes it a prime target for attackers. All WordPress instances should be audited to identify and patch this vulnerability without delay to prevent potential compromise.