What is the CVSS score of CVE-2026-15312?

CVE-2026-15312 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Propovoice are affected by CVE-2026-15312?

Propovoice WordPress plugin versions through 1.7.8 contain an authenticated privilege escalation vulnerability enabling ndpv_manager users to create administrator accounts and assume full site…

How to fix or mitigate CVE-2026-15312?

Within 24 hours, inventory all WordPress deployments running Propovoice through version 1.7.8, identify all ndpv_manager role holders, and audit recent administrator account creations for unauthorized entries. Within seven days, disable the Propovoice plugin on all affected systems until a patch is released; concurrently, rotate credentials for all existing administrator accounts and validate the legitimacy of any newly created administrators. Within 30 days, monitor vendor communications for patch availability, validate and test any released patches in a controlled environment, and implement strict controls limiting ndpv_manager role assignment to only trusted internal administrators.

Propovoice CVE-2026-15312

EUVD-2026-58836 HIGH

Improper Privilege Management (CWE-269)

2026-08-15 Wordfence

GHSA-m3w4-6j2w-6vv5

WordPress Privilege Escalation Wordpress Plugin Propovoice

8.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable REST endpoint, low complexity, PR:L because ndpv_manager role required; full CIA impact on site compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 15, 2026 - 03:00 vuln.today

CVE Published

Aug 15, 2026 - 02:26 cve.org

HIGH 8.8

DescriptionCVE.org

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create() function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted WordPress roles and omitting any promote_users capability check before passing the sanitized value directly to WP_User::set_role(). This makes it possible for authenticated attackers with ndpv_manager-level access and above to create a new WordPress user account with the administrator role assigned, achieving full vertical privilege escalation. The ndpv_manager capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.

AnalysisAI

Privilege escalation in the Propovoice WordPress plugin (all versions through 1.7.8) allows authenticated users holding the plugin-granted ndpv_manager role to create new WordPress accounts with full administrator privileges. The REST endpoint backing the team member create() function passes the user-supplied role parameter directly to WP_User::set_role() without validating it against an allowlist of safe roles or checking the WordPress promote_users capability. No public exploit has been identified at time of analysis, but the attack surface is broader than typical authenticated vulnerabilities because the ndpv_manager role is granted by the plugin itself - not the site administrator - expanding who can trigger the escalation.

Technical ContextAI

Propovoice is a WordPress CRM plugin (CPE: cpe:2.3:a:fassionstorage:propovoice:_all-in-one_client_management_system:*:*:*:*:*:*:*:*) that exposes a REST API for team management. The vulnerable code resides in includes/Api/Type/Team.php, specifically the create() function referenced at lines 169, 219, 423, and 38 of the plugin trunk. The root cause is CWE-269 (Improper Privilege Management): WordPress provides the promote_users capability specifically to gate role assignment, and the correct pattern requires both capability checking and role allowlisting before calling WP_User::set_role(). The plugin skips both controls, trusting a sanitized but otherwise unconstrained caller-supplied role string.

RemediationAI

No exact patched version was confirmed in the provided input data; site administrators should consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/6a39e4d4-890d-46f9-8bb9-0fc858e6f1e2?source=cve) to determine whether a patch has been released since disclosure. As an immediate compensating control, administrators should audit all accounts holding the ndpv_manager role and reduce that list to the minimum necessary users, since each such account represents an exploitation vector. If the plugin is not actively required, deactivating it eliminates the exposed REST endpoint entirely. If deactivation is not operationally feasible, restricting the WordPress REST API to authenticated sessions via firewall or plugin-level policy will not prevent exploitation here (PR:L is already authenticated), but network-level restrictions limiting who can reach the REST API endpoint can reduce the pool of potential attackers. WordPress administrators should also audit for unexpected administrator-role accounts that may indicate prior exploitation.