WP Password Policy

CVE-2026-15992: WP Password Policy password-reset flow allows subscriber-to-Administrator escalation

WP Password Policy through 3.7.1 permits a Subscriber or other authenticated user with a valid password-reset link or cookie for an account they control to escalate that account to Administrator. On the password-reset form, the password_hint filter calls Module_Password_Hint::filter_password_hint() and then get_user(). A crafted POST with action=createuser, the account name in user_login, and administrator in role causes the vulnerable code to resolve the existing account with new WP_User() and pass the attacker-supplied role to WP_User::set_role() without a nonce or authorization check. Version 3.7.2 requires the create-user nonce and create_users capability, verifies that the submitted role is assignable, and uses a non-persistent user object for password-policy context.