CVE-2026-15992
Deferred Deferred - Pending Action

Privilege Escalation in WP Password Policy Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `WP_User::set_role()` with the attacker-supplied `role` parameter on any account resolved via `$_POST['user_login']`, without confirming the requesting user holds the capability to assign roles. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their own privileges to Administrator by submitting a crafted POST request — with `action` set to `createuser` and `role` set to `administrator` — to the password-reset form endpoint. The vulnerable code path is reachable via the `password_hint` filter hooked during the WordPress password-reset form render, meaning an attacker need only possess a valid password-reset cookie to reach the sink.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-15992
EUVD
EUVD-2026-49987

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_password_policy wp_password_policy to 3.7.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in the WP Password Policy WordPress plugin up to version 3.7.1. It allows authenticated attackers with subscriber-level access or higher to escalate their privileges to administrator by exploiting missing authorization checks and nonce verification in the get_user() function. The attacker can manipulate the role parameter in a crafted POST request to set their account role to administrator.

Detection Guidance

Check WordPress sites running the WP Password Policy plugin versions up to 3.7.1. Inspect server logs for POST requests to password-reset forms with action=createuser and role=administrator. Look for unauthorized role changes in user accounts.

Impact Analysis

If you use the WP Password Policy plugin in your WordPress site, an attacker could gain full administrative control of your site. This could allow them to install malicious plugins, modify content, steal data, or take over your entire website. The attack requires only a valid password-reset cookie and subscriber-level access.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, and other regulations. If attackers escalate privileges, they could access, modify, or exfiltrate sensitive data, resulting in regulatory penalties, legal liabilities, and reputational damage.

Mitigation Strategies

Update the WP Password Policy plugin to the latest version immediately. Remove subscriber-level access where unnecessary. Monitor user roles for unauthorized changes. Consider disabling the plugin temporarily if an update is unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15992. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart