CVE-2026-15992 in Password Policy Plugin
Summary
by MITRE • 07/28/2026
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `WP_User::set_role()` with the attacker-supplied `role` parameter on any account resolved via `$_POST['user_login']`, without confirming the requesting user holds the capability to assign roles. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their own privileges to Administrator by submitting a crafted POST request — with `action` set to `createuser` and `role` set to `administrator` — to the password-reset form endpoint. The vulnerable code path is reachable via the `password_hint` filter hooked during the WordPress password-reset form render, meaning an attacker need only possess a valid password-reset cookie to reach the sink.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
The WP Password Policy plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 3.7.1. This flaw resides in the Module_Password_Hint class where the get_user() function fails to implement proper authorization checks and nonce verification mechanisms. The vulnerability manifests when the function unconditionally executes WP_User::set_role() with attacker-controlled role parameters, allowing malicious users to manipulate user roles without proper authentication. The technical implementation lacks essential security controls that should validate whether the requesting user possesses sufficient privileges to assign administrative roles, creating an exploitable condition where unauthorized privilege elevation becomes possible.
The operational impact of this vulnerability is significant as it enables authenticated attackers who already possess subscriber-level access or higher to escalate their privileges to administrator status. Attackers can leverage this weakness by crafting a malicious POST request targeting the password-reset form endpoint with specific parameters including action set to createuser and role set to administrator. The exploit requires only a valid password-reset cookie to reach the vulnerable code path, making it particularly dangerous as it bypasses traditional authentication barriers. This vulnerability operates through the password_hint filter which is hooked during WordPress password-reset form rendering, creating an attack surface that's readily accessible to compromised users.
The root cause of this vulnerability aligns with CWE-863, which addresses "Incorrect Authorization" where a system fails to properly verify that an actor has sufficient privileges to perform a requested action. This weakness directly maps to ATT&CK technique T1078.004, "Valid Accounts: Cloud Accounts," as attackers can exploit existing valid accounts with lower privileges to gain higher-level access. The vulnerability represents a fundamental failure in the principle of least privilege where role assignment controls are completely bypassed without proper verification. This flaw fundamentally undermines WordPress's user role management system and creates a persistent backdoor for attackers who can maintain elevated privileges indefinitely.
Mitigation strategies should focus on immediate plugin updates to versions that address this authorization gap, though administrators must also implement additional security measures such as monitoring for unusual role assignment patterns in their logs. The recommended approach includes enforcing strict nonce validation throughout the password reset process and implementing comprehensive authorization checks before any role modifications occur. Organizations should also consider implementing web application firewalls to detect and block suspicious POST requests targeting the password hint functionality, while maintaining regular security audits of plugin configurations. Security teams must ensure that all user interactions with role management functions are properly authenticated and authorized through robust access control mechanisms that prevent unauthorized privilege escalation attempts.