CVE-2025-13618 is a critical vulnerability in the dreamstechnologies Mentoring WordPress plugin that permits privilege escalation. The issue arises from the mentoring_process_registration() function failing to properly restrict the roles assigned to new users during registration. As a result, unauthenticated attackers can create accounts with administrator privileges, compromising the integrity and security of affected WordPress installations. The vulnerability affects all versions up to 1.2.8. There is no vendor advisory or patch available yet, and no known exploits have been reported in the wild.

Successful exploitation allows unauthenticated attackers to gain administrator-level access to WordPress sites using the vulnerable Mentoring plugin. This can lead to full site compromise, including data theft, site defacement, and further malware installation. The critical CVSS score (9.8) reflects the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or uninstall the Mentoring plugin to prevent exploitation. Monitor official channels from dreamstechnologies for updates and apply patches promptly once available.