CVE-2026-15451

Name of the Vulnerable Software and Affected Versions MemberPress Corporate Accounts versions prior to 1.5.40

Description An issue exists where authenticated attackers with subscriber-level access or higher who hold a corporate account can achieve privilege escalation. This occurs due to a mass assignment flaw in the add sub account user() function, which passes the raw userdata array to wp insert user() without filtering sensitive keys such as role or ID. Mass assignment is a vulnerability where an application takes user-provided data and binds it to an internal object without proper validation, allowing attackers to modify fields they should not have access to. This flaw allows attackers to create new administrator accounts or hijack existing ones by overwriting email addresses.

Recommendations Update to a version later than 1.5.39.