CVE-2026-15992 is a privilege escalation vulnerability in the WP Password Policy WordPress plugin (versions <=3.7.1). The vulnerability is due to missing authorization and nonce verification in the get_user() function of the Module_Password_Hint class. This function unconditionally calls WP_User::set_role() with an attacker-supplied role parameter from a POST request without verifying the requester's capability to assign roles. An authenticated attacker with subscriber-level access or higher can exploit this by sending a crafted POST request with action=createuser and role=administrator to the password-reset form endpoint, escalating their privileges to Administrator. The vulnerable code path is reachable through the password_hint filter during password-reset form rendering, requiring only a valid password-reset cookie to exploit.

An attacker with authenticated subscriber-level access or higher can escalate their privileges to Administrator, gaining full control over the WordPress site. This can lead to complete compromise of the affected site, including content manipulation, user management, and potential further attacks on the hosting environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the password-reset functionality and monitor for suspicious POST requests targeting the password-reset form endpoint. Consider disabling or removing the WP Password Policy plugin if privilege escalation risk is unacceptable.