CVE-2026-15992

Name of the Vulnerable Software and Affected Versions WP Password Policy versions prior to 3.7.2

Description Authenticated users with subscriber-level access or higher can escalate their privileges to Administrator. The issue stems from missing authorization checks and nonce verification (a unique token used to prevent cross-site request forgery) in the get user() function of the Module Password Hint class. This function calls WP User::set role() using the role parameter provided by the attacker for any account identified via $ POST['user login'], without verifying if the requester has the authority to assign roles. An attacker can exploit this by sending a crafted POST request to the password-reset form endpoint with the action parameter set to createuser and the role parameter set to administrator, provided they possess a valid password-reset cookie.

Recommendations Update to a version newer than 3.7.1. As a temporary mitigation, restrict access to the password-reset form endpoint to prevent unauthorized role assignments.