Mementor Core

Mementor Core has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 8.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Improper Privilege Management, behind 1 of the records (100%).

The one issue recorded for Mementor Core has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.

All of these findings were reported by theviper17y. Mementor Core is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh
8.8/ 10
Patch Coverage0%
Open

1

Fixed

0

Get automatic notifications for all Mementor Core vulnerabilities before they are exploited.

Most severe open issueCVSS 8.8CVE-2025-11168

Mementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation

Read the full analysis

Vulnerability Records

1 records
Plugin Profile
Latestv3.0.2
0.0(0)
0/100
Last Updated
2026-07-06 (2mo ago)
Active Installs
10+
Downloads
2,256
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2020-09-16 (6y ago)

Mementor Core is a plugin originally built for Mementor’s own clients – but now available to anyone who might find it useful. Instead of writing the same code from scratch for every project, we moved our most common functionality into this plugin. This keeps all our projects up to date and saves us a lot of time when starting something new or updating existing sites. The features we add are either designed to benefit our clients directly or make it easier for us to maintain websites efficiently. For example, we’ve disabled certain WordPress notification emails, which can be overwhelming when you manage over a hundred sites – especially when other tools are already tracking plugin updates. We’ve also just launched our Text to Speech (TTS) plugin for WordPress. Feel free to check it out! Want more features? Try the Text to Speech PRO version here. Need SEO Tips? If you’d like to know more about Mementor, visit our website: Mementor.no All plugin functionality Disable the notification email sent after a plugin is automatically updated. Disable the notification email sent after a theme is automatically updated. Disable the notification email sent after a new user is registered. Disable the notification email sent after a user changes his/her password. Add a custom Mementor dashboard page (its own admin menu item) plus a Mementor dashboard widget. The standard WordPress dashboard is kept intact. Professional Mementor branding throughout the admin area. Custom admin bar with Mementor logo and quick access menu. Real-time display of latest blog posts from mementor.no. “Visste du at?” (Did you know?) section with rotating informational slides. Integrated contact form (for logged-in users) with multiple file attachment support (JPG, PNG, WEBP, AVIF, PDF, DOC, DOCX, XLSX). Customer portal quick access. Maintenance and backup service indicators. Featured services showcase (Text-to-speech, SEO analysis). Popular services grid display (Webdesign, SEO, Digital marketing, Email marketing, AEO, App development). Hide unnecessary WordPress menus for non-administrators (Comments, Themes, Tools, Elementor Templates). User switching functionality for administrators (accessible from Users menu). Responsive design that works on all devices. Modern UI with Mementor’s brand colors (#FF4B4B primary, #f5eee9 background). Secure AJAX operations with nonce verification. Clean uninstall process that removes all plugin data and transients.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C