CVE-2026-15312
Received Received - Intake

Privilege Escalation in Propovoice WordPress Plugin

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: Wordfence

Description
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-15312
EUVD
EUVD-2026-58836

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
propovoice all-in-one_client_management_system to 1.7.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in the Propovoice plugin for WordPress. It allows authenticated attackers with manager-level access to create a new user account with administrator privileges. The issue occurs because the plugin's REST endpoint does not properly validate the user-supplied role parameter or check capabilities before assigning the administrator role.

Detection Guidance

Check WordPress user roles for unexpected administrator accounts. Inspect REST API logs for calls to the create() function endpoint. Review plugin version in WordPress admin panel to confirm if version 1.7.8 or lower is installed.

Impact Analysis

An attacker could exploit this to gain full control of a WordPress site, allowing them to install malicious plugins, modify content, steal data, or take over the entire website. Even users with limited manager roles granted by the plugin could escalate their privileges.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). Unauthorized privilege escalation may result in unauthorized data exposure or modification, triggering regulatory penalties.

Mitigation Strategies

Update the Propovoice plugin to the latest version. Remove any unauthorized administrator accounts. Restrict ndpv_manager role capabilities to only necessary functions. Monitor user activity for suspicious privilege changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15312. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart