BaseFortify

Publication date: 2025-11-11

Last updated on: 2025-11-12

Assigner: Wordfence

Description

The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-11

Last Modified

2025-11-12

Generated

2026-07-06

AI Q&A

2025-11-11

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11168

Affected Vendors & Products

Vendor	Product	Version / Range
mementor	mementor_core	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

The Mementor Core plugin for WordPress has a Privilege Escalation vulnerability in all versions up to and including 2.2.5. This occurs because the plugin does not properly handle the user switch back function, allowing authenticated users with Subscriber-level access or higher to elevate their privileges by accessing an administrator account through this switch back functionality.

Impact Analysis

This vulnerability can allow an attacker with low-level access (Subscriber or above) to gain administrator privileges on a WordPress site using the Mementor Core plugin. This could lead to full control over the site, including the ability to modify content, change settings, install malicious code, or compromise user data.

Hi! I’m here to help you understand CVE-2025-11168. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70