Privilege Escalation Vulnerability in WP Password Policy Plugin for WordPress

CVE-2026-15992

What is CVE-2026-15992?

The WP Password Policy plugin for WordPress is susceptible to a privilege escalation flaw due to inadequate authorization checks and nonce verification in its 'get_user()' function. This vulnerability allows authenticated attackers with subscriber-level access or higher to escalate their privileges to that of an Administrator. By submitting a specially crafted POST request to the password-reset form endpoint, attackers can manipulate the 'role' parameter, which is processed without proper validation. The flaw is accessible via the 'password_hint' filter in the WordPress password-reset workflow, requiring only a valid password-reset cookie to exploit.

References