MemberPress Corporate Accounts EUVD-2026-76875

Exploitation requires three concurrent conditions: (1) the attacker holds an authenticated WordPress session at subscriber level or above, (2) that account has been granted or purchased a MemberPress corporate account, and (3) the MemberPress Corporate Accounts add-on is installed and active on the target site. Unauthenticated users cannot exploit this. Regular WordPress subscribers without a corporate account cannot exploit this. Admin-account hijacking additionally requires knowing the numeric ID of an existing administrator, which is discoverable via the WordPress REST API on sites that have not disabled user enumeration. Exploitation is limited to WordPress sites running this specific premium add-on; it does not affect the base MemberPress plugin or other MemberPress add-ons.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a realistic threat model: network-accessible, low complexity, and requiring only subscriber-level authentication. The critical constraint not fully captured by raw CVSS is that the attacker must also hold an active MemberPress corporate account - a purchasing requirement that somewhat narrows the realistic attacker pool to paying customers or compromised subscriber accounts. EPSS data was not supplied. No KEV listing or confirmed public POC exists at time of analysis, so the probability of widespread opportunistic exploitation appears lower than the CVSS score alone implies. However, the C:H/I:H/A:H impact rating is well-justified because full administrator account creation provides complete WordPress site compromise. The 'partial patch' disclosure for 1.5.39 is the most operationally significant signal: administrators on 1.5.39 cannot assume they are fully remediated and should monitor Wordfence and the vendor for a subsequent release.

An attacker purchases or obtains a MemberPress corporate account at subscriber level, then crafts a POST request to the add_sub_account_user endpoint, injecting userdata[role]=administrator (and optionally userdata[ID]=<target_admin_id>) into the payload. Because the raw array passes through to wp_insert_user() unchecked, the attacker's chosen role is accepted, resulting in either a freshly minted admin account under their control or a hijacked existing admin account with an attacker-controlled email address, after which a password reset grants full site access. No public exploit code has been identified, but the vulnerability mechanics are straightforward and derivable from the description alone.