CVE Alert: CVE-2025-11168 – mvirik – Mementor Core

**Risk verdict**: High risk due to authenticated privilege escalation; treat as priority 1 if KEV is active or EPSS ≥ 0.5; otherwise remains high urgency.

**Why this matters**: An attacker with Subscriber+ access can elevate to Administrator, potentially taking full control of the WordPress site, exfiltrating data or defacing content. The impact is extensive for sites relying on Mementor Core within WordPress, and the combination of authenticated access with a privilege escalation path makes the scenario realistic in environments with multiple contributor accounts.

**Most likely attack path**: Requires a legitimate subscriber-level account (PR:L) with network access (AV:N, no UI interaction). The attacker exploits the switch-back function to gain admin rights (I:H, C:H, A:H). Once elevated, they can operate with administrator privileges across the site, increasing lateral movement risk within the WordPress admin surface.

**Who is most exposed**: WordPress installations using Mementor Core <= 2.2.5 exposed to contributors or editors who possess subscriber-equivalent access. Organisations with shared hosting or multiple external contributors are particularly vulnerable if admin controls are weak or lax.

**Detection ideas**:

• Unusual admin-session activity initiated from non-admin accounts.
• Privilege-escalation events tied to the switch-back functionality.
• Admin-endpoint access originating from subscriber-level accounts.
• Authentication logs showing rapid role changes for a single user.
• Anomalous across-site actions after a login from a contributor account.

**Mitigation and prioritisation**:

• Patch to latest Mementor Core release or disable the plugin until patched; verify vendor fix.
• Enforce MFA for all admin and high-privilege accounts; implement strict role boundaries.
• Review and tighten subscriber/editor permissions; remove unnecessary switch-back access if possible.
• Validate backups and perform staged testing before deployment; maintain change-control notes.
• If KEV true or EPSS ≥ 0.5: treat as priority 1; otherwise proceed as high-priority remediation.