CVE-2025-11168 affects the Mementor Core plugin for WordPress, allowing privilege escalation through improper privilege management in the user switch back functionality. Authenticated users with Subscriber-level access or above can elevate their privileges to administrator by exploiting this flaw. The vulnerability exists in all versions up to and including 2.2.5. The CVSS 3.1 score of 8.8 reflects a network attack vector with low attack complexity, requiring low privileges but no user interaction, and results in high impact on confidentiality, integrity, and availability. No patch or remediation details are currently provided, and the plugin is not a cloud service, so remediation depends on vendor patching.

Successful exploitation allows an authenticated user with minimal privileges (Subscriber-level or higher) to escalate to administrator privileges. This can lead to full control over the WordPress site, including data compromise, site defacement, or further malicious activity. The high CVSS score indicates critical impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the Mementor Core plugin if possible. Monitor for vendor updates and apply patches promptly once available.