The Mentoring plugin for WordPress up to and including version 1.2.8 contains a critical privilege escalation vulnerability. This flaw allows unauthenticated attackers to register accounts with administrator-level privileges due to improper role restrictions in the registration function.