Technical impact
The Mementor Core plugin for WordPress contains a flaw where its user switch back functionality is not properly guarded. An authenticated user with Subscriber-level access or higher can trigger this function and gain access to an administrator account, thereby elevating their privileges. This issue directly maps to CWE-269: Improper Privilege Management. The result is that a non-administrator can assume full administrative rights, compromising confidentiality, integrity, and availability of the site.
Affected Systems
The vulnerability affects the Mementor Core plugin developed by mvirik. All versions up to and including 2.2.5 are impacted. Any WordPress site that has versions 2.2.5 or earlier installed is at risk.
Risk and Exploitability
With a CVSS score of 8.8 the problem is rated high severity. The EPSS score of less than 1% indicates that exploitation is currently expected to be rare, and the vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated and have at least Subscriber role to use the switch back feature. The exploit is performed over the web interface, so the attack vector is remote via HTTP/HTTPS. If the site allows unrestricted access to the switch back functionality, an attacker can trigger privilege escalation without additional privileges.
