CVE-2026-15451: MemberPress Privilege Escalation Flaw

CVE-2026-15451 Overview

CVE-2026-15451 affects the MemberPress Corporate Accounts plugin for WordPress in versions up to and including 1.5.39. The vulnerability allows authenticated attackers with subscriber-level access or above, who hold a corporate account, to escalate privileges to administrator. The root cause is a mass assignment flaw in the add_sub_account_user function, which passes the raw userdata array to wp_insert_user without filtering sensitive keys such as role or ID. Attackers can create new administrator accounts or hijack existing ones by overwriting their email addresses. The issue is tracked as [CWE-269: Improper Privilege Management]. The vendor released a partial patch in version 1.5.39.

Critical Impact
Authenticated subscribers with corporate account access can create or hijack administrator accounts, leading to full WordPress site compromise.

Affected Products

MemberPress Corporate Accounts plugin for WordPress, versions up to and including 1.5.39
WordPress sites using the MemberPress Corporate Accounts Addon
Any site where users hold a corporate sub-account role

Discovery Timeline

2026-09-12 - CVE-2026-15451 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-15451

Vulnerability Analysis

The vulnerability resides in the add_sub_account_user function of the MemberPress Corporate Accounts plugin. This function is intended to allow corporate account holders to add sub-account users under their subscription. Instead of explicitly whitelisting safe user fields, the function forwards the entire userdata array received from the request to WordPress's wp_insert_user API. WordPress accepts fields such as role, ID, and user_email in this array, and applies them without additional authorization checks when the caller is authenticated. An authenticated corporate account holder can therefore submit crafted parameters that set the new user's role to administrator, or supply an existing administrator's ID to overwrite that account's email address.

Root Cause

The underlying weakness is mass assignment [CWE-269]. The plugin trusts client-supplied input to populate a privileged API without applying a field allowlist or capability check on sensitive attributes like role and ID. Version 1.5.39 introduced only a partial fix, meaning residual paths to abuse the same sink may remain.

Attack Vector

Exploitation requires an authenticated WordPress account with subscriber-level access or higher that is associated with a corporate account. The attacker sends a request to the sub-account creation endpoint with additional parameters injected into the userdata payload. By setting role=administrator, the attacker provisions a new admin account. Alternatively, by supplying an existing administrator's ID along with an attacker-controlled user_email, the attacker overwrites the admin email and can then trigger a password reset to seize the account.

No verified public exploit code is available. See the Wordfence Vulnerability Analysis for further technical details.

Detection Methods for CVE-2026-15451

Indicators of Compromise

Unexpected WordPress user accounts with the administrator role created by a corporate account holder.
Administrator accounts whose user_email was recently changed without a corresponding admin-initiated action.
Password reset emails sent to unfamiliar addresses immediately following sub-account creation requests.
HTTP POST requests to MemberPress Corporate Accounts sub-account endpoints containing role or ID parameters.

Detection Strategies

Inspect web server access logs for requests to the plugin's sub-account creation endpoint that include userdata[role], userdata[ID], or userdata[user_email] fields.
Correlate WordPress user_register and profile_update events with the originating authenticated user; flag events where a non-admin creates or modifies an admin account.
Baseline the population of administrator accounts and alert on new additions outside of change windows.

Monitoring Recommendations

Enable WordPress audit logging for user role changes, email changes, and new user registrations.
Forward WordPress and web server logs to a centralized analytics platform to detect anomalous privilege changes across sites.
Monitor for outbound password-reset emails delivered to previously unseen addresses tied to administrator accounts.

How to Mitigate CVE-2026-15451

Immediate Actions Required

Update the MemberPress Corporate Accounts plugin to at least version 1.5.39, recognizing this is a partial patch, and watch for a follow-up release.
Audit all WordPress accounts with the administrator role and remove any that are unrecognized.
Reset passwords and verify email addresses for all existing administrator accounts.
Review recent activity from users associated with corporate accounts for signs of exploitation.

Patch Information

The vendor released a partial patch in MemberPress Corporate Accounts version 1.5.39. Administrators should install the latest available version and monitor the MemberPress Corporate Accounts Addon page and the Wordfence advisory for a complete fix.

Workarounds

Temporarily disable the MemberPress Corporate Accounts plugin if patching cannot be performed immediately.
Restrict which authenticated users are granted corporate account status until a complete fix is available.
Deploy a web application firewall rule that strips role and ID parameters from requests targeting the plugin's sub-account endpoints.
Enforce multi-factor authentication for all administrator accounts to reduce the impact of email hijacking followed by password reset.

bash

# Example WAF rule concept: block requests to the plugin endpoint
# that attempt to set privileged userdata fields.
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1015451,msg:'CVE-2026-15451 mass assignment attempt'"
SecRule ARGS_NAMES "@rx ^userdata\[(role|ID)\]$" "t:none"