Mementor Core <= 2.2.5 - 認証済み (購読者+) 特権昇格
プラットフォーム
wordpress
コンポーネント
mementor-core
修正版
2.2.6
CVE-2025-11168 describes a Privilege Escalation vulnerability discovered in the Mementor Core WordPress plugin. An attacker with Subscriber-level access or higher can exploit this flaw to gain administrator privileges, potentially compromising the entire WordPress site. This vulnerability affects versions 0.0.0 through 2.2.5, and a patch is available in version 2.2.6.
このCVEがあなたのプロジェクトに影響するか確認
依存関係ファイルをアップロードすれば、このCVEや他のCVEがあなたに影響するか即座にわかります。
影響と攻撃シナリオ翻訳中…
Successful exploitation of CVE-2025-11168 allows an authenticated attacker to bypass access controls and assume the role of an administrator. This grants them complete control over the WordPress site, including the ability to modify content, install malicious plugins, create new user accounts with elevated privileges, and potentially access sensitive data stored within the WordPress database. The impact is significant, as a compromised administrator account can lead to a full site takeover and data breach. This vulnerability highlights the importance of proper user access controls and secure coding practices within WordPress plugins.
悪用の状況翻訳中…
CVE-2025-11168 was publicly disclosed on 2025-11-11. There are currently no known public exploits or active campaigns targeting this vulnerability. The vulnerability is not listed on the CISA KEV catalog at the time of writing. The ease of exploitation, given the requirement of only authenticated Subscriber access, suggests a potential for exploitation if widely publicized.
リスク対象者翻訳中…
WordPress sites utilizing the Mementor Core plugin, particularly those with Subscriber-level users who have access to administrative functions or are part of shared hosting environments, are at risk. Sites with legacy configurations or those that haven't implemented robust user access controls are especially vulnerable.
検出手順翻訳中…
• wordpress / composer / npm:
grep -r 'switch_back_user' /var/www/html/wp-content/plugins/mementor-core/• wordpress / composer / npm:
wp plugin list --status=active | grep mementor-core• wordpress / composer / npm:
wp plugin update mementor-core --all攻撃タイムライン
- Disclosure
disclosure
脅威インテリジェンス
エクスプロイト状況
EPSS
0.07% (22% パーセンタイル)
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- 低 — 有効なユーザーアカウントがあれば十分。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- 高 — 機密性の完全喪失。全データが読み取り可能。
- Integrity
- 高 — 任意のデータの書き込み・変更・削除が可能。
- Availability
- 高 — 完全なクラッシュまたはリソース枯渇。完全なサービス拒否。
影響を受けるソフトウェア
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
- EPSS 更新日
緩和策と回避策翻訳中…
The primary mitigation for CVE-2025-11168 is to immediately upgrade the Mementor Core plugin to version 2.2.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting access to the user switch back functionality. While not a complete fix, this can limit the attacker's ability to exploit the vulnerability. Monitor WordPress access logs for suspicious activity, particularly attempts to access administrative functions from accounts with lower privileges. Implement a Web Application Firewall (WAF) with rules to detect and block attempts to exploit the user switch back functionality.
修正方法翻訳中…
Actualice el plugin Mementor Core a la versión 2.2.6 o superior para mitigar la vulnerabilidad de escalada de privilegios. Esta actualización corrige el manejo incorrecto de la función de cambio de usuario, previniendo que atacantes con privilegios de suscriptor puedan acceder a cuentas de administrador.
CVEセキュリティニュースレター
脆弱性分析と重要アラートをメールでお届けします。
よくある質問翻訳中…
What is CVE-2025-11168 — Privilege Escalation in Mementor Core?
CVE-2025-11168 is a high-severity vulnerability in the Mementor Core WordPress plugin allowing authenticated subscribers to escalate privileges to administrator accounts due to improper user switch back handling.
Am I affected by CVE-2025-11168 in Mementor Core?
You are affected if you are using Mementor Core versions 0.0.0 through 2.2.5. Upgrade to 2.2.6 to resolve the issue.
How do I fix CVE-2025-11168 in Mementor Core?
Upgrade the Mementor Core plugin to version 2.2.6 or later. If immediate upgrade is not possible, restrict access to the user switch back functionality.
Is CVE-2025-11168 being actively exploited?
As of the current date, there are no confirmed reports of active exploitation, but the vulnerability's ease of exploitation warrants caution.
Where can I find the official Mementor Core advisory for CVE-2025-11168?
Refer to the plugin developer's website or WordPress plugin repository for the official advisory and release notes for version 2.2.6.