Propovoice <= 1.7.8 Privilege Escalation via 'role' Parameter (CVE-2026-15312)

Vulnerability Overview Vulnerability Name: Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter CVE ID: CVE-2026-15312 CVSS Score: 8.8 (High) Release Date: August 14, 2026 Last Updated: August 15, 2026 Researcher: Wordfence PRISM - Wordfence Impact Scope Software Type: Plugin Software Name: Propovoice: All-in-One Client Management System Affected Versions: <= 1.7.8 Vulnerability Description: This vulnerability allows an authenticated attacker to achieve full vertical privilege escalation on WordPress user accounts by modifying the 'role' parameter to elevate themselves to the 'ndpv_manager' role. Remediation Patch Status: No known patch Recommended Actions: Please review the vulnerability details carefully and implement mitigation measures based on your organization's risk tolerance. It is recommended to uninstall the affected software and seek an alternative solution. Related Vulnerabilities CVE-2025-6422: Propovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Read CVE-2024-43550: Propovoice CRM <= 1.7.8 - Unauthenticated Insecure Direct Object Reference CVE-2024-4747: Propovoice CRM <= 1.7.6.2 - Unauthenticated Stored Cross-Site Scripting Additional Information Wordfence Intelligence: Offers free personal and commercial API access, as well as free webhook integration. Wordfence WordPress Plugin: Provides instant notifications of the latest vulnerabilities on your WordPress site. Contact Information Technical Support: 24/7 support, 365 days a year, with a 1-hour response time. Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays). Legal Disclaimer Copyright: © 2012-2026 Defiant Inc. All Rights Reserved License: Licensed under CC BY 4.0. Related Links Wordfence Intelligence Wordfence WordPress Plugin Wordfence Documentation Social Media Twitter LinkedIn Facebook Instagram Subscription Subscribe to Wordfence News: Enter your email address, check the box to agree to the Terms of Service and Privacy Policy, and click the “SIGN UP” button. Footer Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Stay Updated: Subscribe to Wordfence news and updates Other Terms of Service: Link Privacy Policy and Notice at Collection: Link Do Not Sell or Share My Personal Information: Link Summary This page provides a detailed overview of a privilege escalation vulnerability in Propovoice: All-in-One Client Management System, including vulnerability overview, impact scope, remediation, and related information. Users are advised to take steps to patch or replace the affected software as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

Propovoice <= 1.7.8 Privilege Escalation via 'role' Parameter (CVE-2026-15312)

More from this source