CVE-2026-15312: Propovoice: All-in-One Client Management System <= 1.7.8 - Authenticated (ndpv_manager+) Privilege Escalation via 'role' Parameter

The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the create() function's REST endpoint failing to validate the user-supplied role parameter against an allowlist of permitted WordPress roles and omitting any promoteusers capability check before passing the sanitized value directly to WPUser::setrole(). This makes it possible for authenticated attackers with ndpvmanager-level access and above to create a new WordPress user account with the administrator role assigned, achieving full vertical privilege escalation. The ndpvmanager capability is a sub-administrator CRM team role granted by Propovoice itself, meaning the attack surface extends beyond site administrators to any user the plugin has elevated to a manager position.