CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5. This is due to plugin not properly handling the user switch back function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges by accessing an administrator account through the switch back functionality.
Explanation of Vulnerability in Simple Terms
Mementor Core versions up to 2.2.5 contain a privilege management flaw that allows authenticated users with low-level access to gain unauthorized elevated privileges. An attacker with a basic user account can read, modify, or delete sensitive data and disrupt site operations. The vulnerability requires network access and a valid login but no additional user interaction.
What an attacker can do
Read, modify, or delete sensitive data; disrupt site availability with a low-privilege user account.
Potential impact on your site
Any registered user can escalate their access to perform admin-level actions, compromising data integrity and site availability.
Conditions required to exploit
Valid login credentials with low-level user privileges; network access to the application.
Key dates
External resources
