CVE-2026-15312
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Propovoice plugin for WordPress up to version 1.7.8 is vulnerable to privilege escalation. The create() function in the REST endpoint fails to validate the role parameter against an allowlist and omits the promote_users capability check, passing the value directly to WP_User::set_role(). Authenticated attackers with ndpv_manager access can create an administrator account.
Risk Assessment
A user with limited manager privileges can gain full administrator rights, leading to complete site compromise.
Recommendation
Update the Propovoice plugin to the latest patched version. Restrict the ndpv_manager role to trusted users only.
Original NVD description (English source)
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.