MemberPress Corporate Accounts mass assignment creates administrators
MemberPress Corporate Accounts through 1.5.39 passes the raw userdata array from add_sub_account_user to wp_insert_user without filtering role or ID. A subscriber who holds a corporate account can create a new administrator or target an existing administrator ID and overwrite its email address. Version 1.5.39 only partially patched the issue.
- Component
- MemberPress Corporate Accounts
- Plugin slug
memberpress-corporate-accounts- Affected
- <= 1.5.39
- Safe version
- See mitigation notes
- Published
- Sep 12, 2026
This CVE was published Sep 12, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
No fully fixed release is confirmed in the authoritative export; 1.5.39 remains affected. Restrict corporate-account access or deactivate the add-on until the vendor confirms a complete fix. The application-level fix must construct an allowlisted user array server-side and forbid caller control of role, ID, capabilities, login, and privileged account identifiers.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H