Skip to content
Threat Feed
Subscribe

Product

WP Password Policy

1 brief RSS
critical advisory

WP Password Policy Plugin Privilege Escalation via Crafted POST Request (CVE-2026-15992)

The WP Password Policy plugin for WordPress, in versions up to and including 3.7.1, is vulnerable to privilege escalation, allowing authenticated attackers with subscriber-level access to escalate their privileges to Administrator by sending a crafted POST request to the password-reset form endpoint, leveraging missing authorization checks and nonce verification.

WP Password Policy wordpress privilege-escalation web-vulnerability php
1r 1t 1c