The Mentoring plugin for WordPress contains a flaw that allows any visitor to register a new user account that is automatically assigned an administrator role. This occurs because the plugin fails to limit the roles that can be requested during the mentoring_process_registration() process, creating a direct privilege escalation vulnerability for unauthenticated users.

Sites that have installed the Mentoring plugin from dreamstechnologies and are running any version up to and including 1.2.8 are affected. The vulnerability exists independently of the WordPress core version since it resides wholly in the plugin code.

The CVSS score of 9.8 classifies this issue as critical. The EPSS score is not provided, and the vulnerability is not listed in CISA KEV, but its high severity combined with an unauthenticated attack vector renders it attractive to attackers. An attacker can simply send an HTTP POST to the registration endpoint and receive an administrator account, achieving full control of the site without any prior access.