The WP Password Policy plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 3.7.1. The flaw exists in the get_user() method of the Module_Password_Hint class, where a missing authorization check and nonce verification allow a crafted POST request to call WP_User::set_role() with an attacker‑supplied role. This can elevate a user with only subscriber‑level access to the Administrator role, compromising the entire site. The weakness is classified as CWE‑269: Missing Authorization.

The vulnerability affects the WP Password Policy plugin from Teydeastudio, versions 3.7.1 and below. Any WordPress installation that has this plugin installed and enabled, where users can login, is at risk. No specific WordPress core version is required beyond the presence of the plugin.

The CVSS score of 8.8 indicates a high severity risk. The EPSS score of < 1% reflects a very low probability of exploitation in the wild at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers must be authenticated and possess a valid password‑reset cookie to reach the vulnerable code path, meaning that authorized users of the site can exploit it without additional privileges. If the plugin is present and not patched, the risk remains significant within the affected environment.