CVE-2026-15312

Name of the Vulnerable Software and Affected Versions Propovoice: All-in-One Client Management System versions prior to 1.7.9

Description An issue exists where the REST endpoint of the create() function fails to validate the user-supplied role parameter against a list of permitted WordPress roles and does not perform a promote users capability check before passing the value to WP User::set role(). This allows authenticated attackers with ndpv manager level access or higher—a sub-administrator CRM team role—to create a new WordPress user account with the administrator role, resulting in full vertical privilege escalation.

Recommendations Update Propovoice: All-in-One Client Management System to version 1.7.9 or later.