The Propovoice: All-in-One Client Management System plugin for WordPress contains a flaw in its REST endpoint where the user‑supplied "role" parameter is not verified against an allowlist of legitimate WordPress roles, and a capability check for promote_users is omitted before the value is passed to WP_User::set_role(). As a result, any authenticated user possessing the ndpv_manager capability or higher can inject the role value "administrator" into the request, causing the creation of a new WordPress user account with full administrative privileges. This flaw is a direct abuse of authorization controls and yields complete vertical privilege escalation.

The vulnerability affects the Propovoice: All-in-One Client Management System plugin, versions 1.7.8 and earlier, installed on WordPress sites. Users in the plugin’s "ndpv_manager" role or higher are able to execute the exploit.

With a CVSS score of 8.8, the issue classifies as high severity. The EPSS score is not available, so we cannot quantify current exploitation likelihood, but the flaw can be triggered by any user with ndpv_manager capability via a simple REST API call and does not require higher privileges. The vulnerability is not listed in the CISA KEV catalog, yet the absence of enforcement logic makes it highly exploitable in environments where the ndpv_manager role is widely granted.