Description

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-12T13:16:50.940Z",
  "pubdate": "2026-09-12T13:16:50.940Z",
  "executiveSummary": "The MemberPress Corporate Accounts plugin for WordPress, in versions up to and including 1.5.39, contains a critical mass assignment vulnerability. This security flaw stems from the insecure handling of user-supplied input within the 'add_sub_account_user' function, which fails to adequately sanitize the 'userdata' array before passing it to 'wp_insert_user'.\nThe vulnerability allows an authenticated attacker possessing a corporate-level subscriber account to conduct unauthorized privilege escalation. By injecting arbitrary keys into the 'userdata' array, an attacker can manipulate account creation and modification processes. This enables the creation of new administrative accounts or the takeover of existing administrator credentials by overwriting sensitive fields such as email addresses.\nThe impact of this vulnerability is severe, potentially leading to full site compromise, unauthorized data access, and loss of administrative control. Exploitation requires the attacker to be authenticated as a valid corporate account holder. The flaw highlights a significant failure in input validation and secure coding practices when integrating user-supplied data into WordPress core user management functions.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the 'add_sub_account_user' function within the MemberPress Corporate Accounts plugin. The function accepts a 'userdata' array directly from the request and passes it to the WordPress core function 'wp_insert_user' without implementing a whitelist or adequate filtering mechanism. In WordPress, 'wp_insert_user' is capable of processing various user meta and profile attributes, including roles and user IDs.\nBecause the 'userdata' array is not sanitized, the application is susceptible to mass assignment. An attacker can supply additional parameters—specifically 'role' or 'ID'—within the request payload. When 'wp_insert_user' receives these unsanitized keys, it processes them as legitimate instructions for the user object. If an attacker sets the 'role' key to 'administrator', the function creates or updates the target user record with administrative privileges.\nThe attack flow proceeds as follows: First, the attacker must be authenticated as a user with a corporate account. Second, the attacker triggers the 'add_sub_account_user' functionality via a crafted HTTP request. By manipulating the POST data to include malicious keys such as 'role' => 'administrator' or by targeting an existing administrator's email address in the 'user_email' field, the attacker bypasses standard access control checks.\nThis vulnerability is particularly dangerous because it leverages built-in WordPress functions to perform unauthorized actions. By injecting an administrative 'role' into the request, the application automatically grants the user elevated permissions upon account creation. Alternatively, by modifying existing administrator user records through account hijacking, the attacker can reset passwords or gain complete control over administrative workflows.\nThe vulnerable component is identified as the 'add_sub_account_user' function. The vulnerability persists in all versions up to and including 1.5.39. While a partial patch was implemented in version 1.5.39, the underlying logic flaw regarding improper input filtering remained largely unaddressed, leaving systems exposed to privilege escalation. Successful exploitation results in the attacker obtaining an account with the highest level of system privileges, enabling further malicious activities, including plugin manipulation, file uploads, and arbitrary code execution."
}