Memberpress Corporate Accounts
Monthly
Privilege escalation in the MemberPress Corporate Accounts WordPress plugin (≤1.5.39) allows authenticated subscribers holding a corporate account to create new administrator accounts or hijack existing ones by overwriting their email addresses. The root cause is a mass assignment flaw in the `add_sub_account_user` function, which forwards the raw `userdata` POST array directly to WordPress's `wp_insert_user()` without stripping sensitive keys such as `role` or `ID`. Wordfence reported the vulnerability; a partial patch was released in version 1.5.39, meaning even the latest disclosed version may still be exploitable in some code paths. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the MemberPress Corporate Accounts WordPress plugin (≤1.5.39) allows authenticated subscribers holding a corporate account to create new administrator accounts or hijack existing ones by overwriting their email addresses. The root cause is a mass assignment flaw in the `add_sub_account_user` function, which forwards the raw `userdata` POST array directly to WordPress's `wp_insert_user()` without stripping sensitive keys such as `role` or `ID`. Wordfence reported the vulnerability; a partial patch was released in version 1.5.39, meaning even the latest disclosed version may still be exploitable in some code paths. No public exploit code or CISA KEV listing has been identified at time of analysis.