Memberpress Corporate Accounts
Approved changes feed: RSS · Atom
cpe:2.3:a:memberpress:memberpress_corporate_accounts:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Memberpress (3ddae94a-1735-5b2f-a30e-0e6caf5eb703) |
|---|---|
| Product | Memberpress Corporate Accounts (de1a8612-b1b9-502f-9285-df53502c765a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-15451 |
vulnerable | 2026-09-16 04:33:06.386269 |
MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation
HIGH (8.8)
The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.
Published: 2026-09-12T12:30:04.807Z
Updated: 2026-09-14T15:59:45.456Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.