CyberRota Analysis
AI-GeneratedThe Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to privilege escalation, allowing authenticated users with `ndpv_manager` access to create new accounts with `administrator` roles. This flaw arises from inadequate validation of the `role` parameter in the `create()` function's REST endpoint, enabling attackers to gain full control over the WordPress site. WordPress site administrators and users of the Propovoice plugin should prioritize immediate updates to mitigate this high-severity vulnerability.
Original NVD Description
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The `ndpv_manager` capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.