{"id":"CVE-2026-15312","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-15312","summary":"The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()`…","details":"The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.","published":"2026-08-15T03:16:47.817","modified":"2026-08-15T03:16:47.817","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Team.php#L169"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Team.php#L219"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Team.php#L38"},{"type":"WEB","url":"https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Team.php#L423"},{"type":"WEB","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/6a39e4d4-890d-46f9-8bb9-0fc858e6f1e2?source=cve"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-15T03:16:47.817"}}