CVE-2026-15451

MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation

View on CVE.org

Published Sep 12, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.

Analysis

Technical impact

The MemberPress Corporate Accounts plugin for WordPress contains a mass assignment flaw in the add_sub_account is passed directly to wp_insert_user without filtering dangerous keys such as role or ID. This flaw allows an authenticated user with subscriber-level access or higher, who also has a corporate account, to create new administrator accounts or hijack existing administrators by overriding their email addresses.

Affected Systems

All installations of the MemberPress Corporate Accounts plugin for WordPress up to and including version 1.5.39 are affected. Users who possess a corporate account and have at least subscriber privileges can exercise the vulnerable sub‑account creation feature.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of < 1% estimates a very low exploitation probability, yet the known lack of a KEV listing and the clear exploitation path through an authenticated user suggest that the risk remains significant. An attacker can bypass normal role restrictions via mass assignment and gain administrative control in the WordPress environment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MemberPress

MemberPress Corporate Accounts

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.5.39

No data.

Vendor Product Versions

Memberpress

Memberpress Corporate Accounts

Version	Status	Scheme	Platform
`[0,1.5.39]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the MemberPress Corporate Accounts plugin to the latest stable version that fully resolves the mass assignment issue.
Limit or remove subscriber‑level users from accessing the sub‑account creation function, or disable corporate account privileges for users who should not be able to create sub‑accounts.
Review existing user accounts and roles to ensure that no unauthorized administrative accounts exist and that role assignments conform to the principle of least privilege.

Generated by OpenCVE AI on September 15, 2026 at 18:00 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.442% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://memberpress.com/addons/corporate-accounts/
https://www.wordfence.com/threat-intel/vulnerabilities/id/ba49bbf9-649b-456e-bab8-9f0f74bdbaee?source=cve

History

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Memberpress Memberpress memberpress Corporate Accounts Wordpress Wordpress wordpress
Vendors & Products		Memberpress Memberpress memberpress Corporate Accounts Wordpress Wordpress wordpress

Sep 12, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.
Title		MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation
Weaknesses		CWE-269
References		https://memberpress.com/addons/corporate-accounts/ https://www.wordfence.com/threat-intel/vulnerabilities/id/ba49bbf9-649b-456e-bab8-9f0f74bdbaee?source=cve
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`