Executive Summary

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This vulnerability allows authenticated attackers with `ndpv_manager`-level access and above to create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation. The CVSS score for this vulnerability is 8.8, indicating a high severity level.

Technical Analysis

The vulnerability is caused by the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value directly to `WP_User::set_role()`. This makes it possible for attackers to escalate their privileges.

How It Gets Exploited

An authenticated attacker with `ndpv_manager`-level access and above can exploit this vulnerability by sending a crafted request to the `create()` function's REST endpoint with a malicious `role` parameter. The attacker would need to have the `ndpv_manager` capability, which is a sub-administrator CRM team role granted by Propovoice itself. Once the request is processed, the attacker can create a new WordPress user account with the `administrator` role assigned, achieving full vertical privilege escalation.

Impact Assessment

The Propovoice: All-in-One Client Management System plugin for WordPress versions up to, and including, 1.7.8 are affected. An attacker can achieve full vertical privilege escalation, allowing them to create a new WordPress user account with the `administrator` role assigned. The CVSS score for this vulnerability is 8.8, indicating a high severity level.

Recommended Actions

Update the Propovoice: All-in-One Client Management System plugin to version 1.7.9 or later. Additionally, monitor your WordPress site for any suspicious activity, such as the creation of new user accounts with elevated privileges.

Sources

  • National Vulnerability Database (NVD)
  • Wordfence