Propovoice EUVD-2026-58836

Exploitation requires an authenticated session with at minimum the ndpv_manager capability, which is a CRM team management role created and assigned by the Propovoice plugin itself - not a default WordPress role. This means the attacker must either be a legitimate plugin-elevated user (e.g., a CRM manager employee) or must have previously compromised any such account. The REST endpoint must be reachable over the network, which is standard for WordPress REST API installations. No special server configuration beyond having the plugin active is required. Exploitation is limited by the need for ndpv_manager-level or higher access; unauthenticated or subscriber/contributor-level WordPress users cannot trigger this flaw. The expanded attack surface relative to typical authenticated flaws is that ndpv_manager accounts may exist outside the site administrator's direct control.

CVSS 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the severity: network-reachable, low complexity, and full CIA impact once the attacker holds the ndpv_manager role. The PR:L rating is appropriate and important - this is not unauthenticated exploitation; a session with at least ndpv_manager-level access is required. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. KEV status is not present, and no public exploit has been identified at time of analysis. The primary risk amplifier is the attack surface expansion: because the ndpv_manager role is conferred by the plugin rather than site administrators, any organization using Propovoice's team delegation features has created additional accounts capable of triggering the escalation - a small operation running WordPress for client management could expose itself without realizing a manager-level employee holds exploitable access. The absence of a reported patch version is a concern; remediating organizations should confirm fix availability via the Wordfence advisory before assuming a safe upgrade path.

An attacker who has obtained or legitimately holds ndpv_manager credentials on a target WordPress site sends a crafted POST request to the Propovoice team member creation REST endpoint, supplying 'administrator' as the role parameter. Because the endpoint performs no role allowlist validation and no promote_users capability check, WordPress processes the request and creates a fully privileged administrator account under attacker control. The attacker then authenticates with the new account, achieving unrestricted access to the site including theme/plugin file editing and arbitrary PHP execution. No public exploit code has been identified at time of analysis.