Executive brief
The MemberPress Corporate Accounts plugin for WordPress allows authorized sub-account holders to create or hijack administrator accounts due to improper input validation. An attacker with a valid subscriber account in a corporate membership can elevate their privileges to administrator level or take over existing admin accounts by modifying email addresses, potentially gaining full control of the website.
Technical details
A mass assignment vulnerability exists in the 'add_sub_account_user' function, which passes the raw 'userdata' array directly to 'wp_insert_user' without filtering dangerous keys such as 'role' or 'ID'. This allows authenticated attackers holding a corporate account at subscriber level or above to inject arbitrary user data during sub-account creation, including role elevation to administrator or email modification of existing administrators. The vulnerability requires an active corporate account membership and subscriber-level or higher access, and was partially patched in version 1.5.39 with more comprehensive hardening added in version 1.6.0.
Affected products
- MemberPress Corporate Accounts up to and including 1.5.39
Timeline
- 2026-09-12: disclosed
- 2026-09-07: patched: Version 1.6.0 includes security hardening; partial patch in 1.5.39
- 2026-07-11: other: Version 1.5.39 partial patch released