CVE-2026-15312 describes a privilege escalation vulnerability in the Propovoice: All-in-One Client Management System WordPress plugin affecting all versions up to 1.7.8. The vulnerability arises from the create() REST endpoint's failure to validate the role parameter against an allowlist of permitted WordPress roles and omission of a promote_users capability check before passing the sanitized role value to WP_User::set_role(). This allows authenticated users with ndpv_manager-level access, a sub-administrator role granted by the plugin, to create new WordPress accounts with administrator privileges, resulting in full vertical privilege escalation beyond site administrators.

An attacker with ndpv_manager-level access or higher can exploit this vulnerability to create new WordPress user accounts with administrator privileges. This grants the attacker full control over the WordPress site, including the ability to modify site content, install plugins, and manage other users. The vulnerability extends the attack surface beyond site administrators to any user assigned the ndpv_manager role by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the assignment of the ndpv_manager role to fully trusted users only. Monitor for suspicious user creation activity and consider disabling or restricting the vulnerable plugin if possible.