A critical privilege escalation vulnerability in the Mentoring WordPress plugin allows unauthenticated users to register and gain administrative access to the platform.

The plugin fails to properly restrict registration roles in the mentoring_process_registration() function. This allows an unauthenticated attacker to supply a role parameter during the registration process, granting them elevated privileges upon account creation.

An attacker gaining administrative access can compromise the entire site, inject malicious scripts, steal sensitive user data, or disable security measures. The CVSS score of 9.8 underscores the gravity of this vulnerability, as it provides a trivial path to full system ownership.

Immediate Action: Update the Mentoring plugin to the latest version, which includes strict role validation during the registration process.

Proactive Monitoring: Review the user list for any unauthorized administrator accounts created recently and monitor registration logs for suspicious role-assignment attempts.

Compensating Controls: Disable public user registration on the WordPress site until the plugin can be updated to prevent exploitation.

Public Exploit Available: No

This vulnerability provides an immediate and easy path to administrative compromise. It is imperative that administrators either patch the plugin immediately or disable the registration features until a secure version is deployed.