WordPress Mentoring Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Mentoring plugin for WordPress, affecting all versions through 1.2.8. The issue arises because the plugin's 'mentoring_process_registration()' function does not properly limit the user roles that can be registered. This flaw allows unauthenticated attackers to create accounts with administrator privileges.

Impact

Exploitation of this vulnerability allows unauthenticated users to register as administrators, potentially leading to unauthorized access and control over the WordPress site.

Remediation

Users can update to version 1.2.9 or a newer patched version to address this vulnerability.