Privilege Escalation in Propovoice Client Management System for WordPress

CVE-2026-15312

What is CVE-2026-15312?

The Propovoice plugin for WordPress exposes a significant security risk due to improper validation of user roles in its REST API. The vulnerable create() function allows authenticated users with ndpv_manager access, a sub-administrator role defined by the plugin, to assign themselves higher privileges, including the administrator role. This oversight leads to potential abuse, enabling users to gain full control over the WordPress site without sufficient checks on user permissions.

References