Mentoring (WordPress) EUVD-2025-209637

WordPress user registration must be enabled via Settings → General → 'Anyone can register' checkbox. The Mentoring theme's registration functionality must be active and processing user signups through the mentoring_process_registration() function. Exploitation is remote and unauthenticated (PR:N) against sites meeting these configuration requirements. Limiting factor: many production WordPress sites disable public registration for security and spam prevention, which completely prevents exploitation. The theme appears targeted at education and mentoring platforms where student/mentee registration is a core feature, making registration-enabled deployments more likely in this theme's user base than general WordPress sites. No special network access, browser conditions, or user interaction required beyond standard HTTP connectivity to the WordPress registration endpoint.

CVSS 9.8 with AV:N/AC:L/PR:N/UI:N indicates maximum exploitability: network-accessible, low complexity, no authentication, no user interaction required. This represents immediate remote compromise risk. The vulnerability creates administrator accounts, granting complete WordPress control (content manipulation, plugin installation, database access, potential server compromise via malicious plugins). Real-world risk depends critically on whether user registration is enabled in site settings-many WordPress sites disable public registration, which eliminates the attack surface entirely. For sites with open registration, this is a shoot-on-sight priority. EPSS data not provided, limiting exploitation probability assessment. No KEV status indicates no confirmed widespread exploitation, but the technical simplicity (AC:L) suggests high automation potential if registration endpoints are exposed. The commercial theme distribution model may limit attack surface compared to free WordPress.org plugins (smaller installation base, but also slower patch adoption due to manual update requirements). Critical gap: exploitation requires registration to be enabled, but input data doesn't confirm if this is default configuration or requires admin opt-in.

Attacker identifies WordPress site running Mentoring theme version ≤1.2.8 with user registration enabled. Attacker crafts registration POST request to mentoring_process_registration() endpoint, injecting 'administrator' role parameter alongside username, email, and password fields. Plugin processes registration without validating role parameter, creating administrator account. Attacker logs in with newly created admin credentials and achieves complete site control-installing backdoor plugins, exfiltrating user data, defacing content, or pivoting to server infrastructure. POC development trivial given clear function name and standard WordPress registration patterns.