WP Password Policy password-reset flow allows subscriber-to-Administrator escalation
WP Password Policy through 3.7.1 permits a Subscriber or other authenticated user with a valid password-reset link or cookie for an account they control to escalate that account to Administrator. On the password-reset form, the password_hint filter calls Module_Password_Hint::filter_password_hint() and then get_user(). A crafted POST with action=createuser, the account name in user_login, and administrator in role causes the vulnerable code to resolve the existing account with new WP_User() and pass the attacker-supplied role to WP_User::set_role() without a nonce or authorization check. Version 3.7.2 requires the create-user nonce and create_users capability, verifies that the submitted role is assignable, and uses a non-persistent user object for password-policy context.
- Component
- WP Password Policy
- Plugin slug
password-requirements- Affected
- <= 3.7.1
- Safe version
3.7.2- Published
- Jul 28, 2026
This CVE was published Jul 28, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update WP Password Policy to 3.7.2 or later. Review role changes and Administrator accounts for unexpected promotions originating from password-reset activity.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Password Policy plugin for WordPress is vulnerable to Privilege Escalation in all versions up to and including 3.7.1. This is due to missing authorization checks and nonce verification in the `get_user()` function of the `Module_Password_Hint` class, which unconditionally calls `WP_User::set_role()` with the attacker-supplied `role` parameter on any account resolved via `$_POST['user_login']`, without confirming the requesting user holds the capability to assign roles. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their own privileges to Administrator by submitting a crafted POST request — with `action` set to `createuser` and `role` set to `administrator` — to the password-reset form endpoint. The vulnerable code path is reachable via the `password_hint` filter hooked during the WordPress password-reset form render, meaning an attacker need only possess a valid password-reset cookie to reach the sink.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H