EUVD-2026-76875
GHSA-43m3-49cj-3hqf
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
PR:L reflects mandatory subscriber-level authentication plus corporate account; network vector and full CIA impact justified by remote admin takeover capability.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.
AnalysisAI
Privilege escalation in the MemberPress Corporate Accounts WordPress plugin (≤1.5.39) allows authenticated subscribers holding a corporate account to create new administrator accounts or hijack existing ones by overwriting their email addresses. The root cause is a mass assignment flaw in the add_sub_account_user function, which forwards the raw userdata POST array directly to WordPress's wp_insert_user() without stripping sensitive keys such as role or ID. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the attacker holds an authenticated WordPress session at subscriber level or above, (2) that account has been granted or purchased a MemberPress corporate account, and (3) the MemberPress Corporate Accounts add-on is installed and active on the target site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a realistic threat model: network-accessible, low complexity, and requiring only subscriber-level authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade MemberPress Corporate Accounts to the latest available version beyond 1.5.39, as the 1.5.39 release is explicitly described as only a partial fix; contact MemberPress support or monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ba49bbf9-649b-456e-bab8-9f0f74bdbaee for the fully patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using MemberPress Corporate Accounts ≤1.5.39 and restrict subscriber-level permissions to prevent user creation or role modification. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Memberpress
View allThe Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and inclu
The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘message’ and 'error' param
Missing Authorization vulnerability in Caseproof, LLC MemberPress memberpress.11.34. Rated medium severity (CVSS 6.5), t
The Memberpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘arglist’ parameter in all ver
The Memberpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mepr_screenname' and 'mepr
The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today