CVE-2025-11168

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11168", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-29T17:03:10.732Z", "datePublished": "2025-11-11T03:30:33.945Z", "dateUpdated": "2026-04-08T16:42:11.345Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:11.345Z"}, "affected": [{"vendor": "mvirik", "product": "Mementor Core", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality."}], "title": "Mementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2460e7c4-76dc-4bc3-bc06-b52df64f5353?source=cve"}, {"url": "http://plugins.trac.wordpress.org/browser/mementor-core/trunk/inc/functions.php#L1033"}, {"url": "https://wordpress.org/plugins/mementor-core/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2025-11-10T15:06:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T17:12:50.548595Z", "id": "CVE-2025-11168", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:08:54.182Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11168", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-12T17:12:50.548595Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T17:12:52.883Z"}}], "cna": {"title": "Mementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation", "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "mvirik", "product": "Mementor Core", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "2.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:06:10.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2460e7c4-76dc-4bc3-bc06-b52df64f5353?source=cve"}, {"url": "http://plugins.trac.wordpress.org/browser/mementor-core/trunk/inc/functions.php#L1033"}, {"url": "https://wordpress.org/plugins/mementor-core/"}], "descriptions": [{"lang": "en", "value": "The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-11T03:30:33.945Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11168", "state": "PUBLISHED", "dateUpdated": "2025-11-12T20:08:54.182Z", "dateReserved": "2025-09-29T17:03:10.732Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:33.945Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Mementor Core", "vendor": "mvirik", "versions": [{"lessThanOrEqual": "2.2.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality."}, {"lang": "es", "value": "El plugin Mementor Core para WordPress es vulnerable a escalada de privilegios en todas las versiones hasta la 2.2.5, inclusive. Esto se debe a que el plugin no maneja correctamente la funci\u00f3n de reversi\u00f3n de usuario. Esto hace posible que atacantes autenticados, con acceso de nivel de Suscriptor y superior, eleven sus privilegios al acceder a una cuenta de administrador a trav\u00e9s de la funcionalidad de reversi\u00f3n de usuario."}], "id": "CVE-2025-11168", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11168", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T17:12:50.548595Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:41.100", "references": [{"source": "security@wordfence.com", "url": "http://plugins.trac.wordpress.org/browser/mementor-core/trunk/inc/functions.php#L1033"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/mementor-core/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2460e7c4-76dc-4bc3-bc06-b52df64f5353?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-27T22:54:38.919623+00:00", "value": {"mitigation_remediation": ["Apply the latest Mementor Core plugin version (2.3 or newer) to remove the flaw.", "If an upgrade cannot be performed immediately, temporarily disable the plugin or the switch back feature to block the exploitation path.", "Enforce stricter role checks for the switch back function, ensuring only administrators can perform user switching."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Mementor Core plugin developed by mvirik. All versions up to and including 2.2.5 are impacted. Any WordPress site that has versions 2.2.5 or earlier installed is at risk.", "description_and_impact": "The Mementor Core plugin for WordPress contains a flaw where its user switch back functionality is not properly guarded. An authenticated user with Subscriber-level access or higher can trigger this function and gain access to an administrator account, thereby elevating their privileges. This issue directly maps to CWE-269: Improper Privilege Management. The result is that a non-administrator can assume full administrative rights, compromising confidentiality, integrity, and availability of the site.", "risk_and_exploitability": "With a CVSS score of 8.8 the problem is rated high severity. The EPSS score of less than 1% indicates that exploitation is currently expected to be rare, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and have at least Subscriber role to use the switch back feature. The exploit is performed over the web interface, so the attack vector is remote via HTTP/HTTPS. If the site allows unrestricted access to the switch back functionality, an attacker can trigger privilege escalation without additional privileges."}}}}, "created": "2025-11-12T12:47:48.209539+00:00", "updated": "2026-04-27T23:00:13.983757+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}