CVE-2026-15312Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter
Updated under an hour ago ()
Does this affect you?
It affects fassionstorage Propovoice: All-in-One Client Management System. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-269
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Wordfence
- NVD analysis
- Deferred
- Record last updated
- Aug 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
fassionstorage Propovoice: All-in-One Client Management System fassionstorage:propovoice_all_in_one_client_management_system (from the name) | through 1.7.8 | CNA record |
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6a39e4d4-890d-46f9-8bb9-0fc858e6f1e2?source=cve
- https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Team.php#L219
- https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Team.php#L169
- https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Team.php#L423
- https://plugins.trac.wordpress.org/browser/propovoice/trunk/includes/Api/Type/Team.php#L38
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.