Cpe:2.3:a:memberpress:memberpress_corporate_accounts:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amemberpressmemberpress_corporate_accountswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 12 Sep 2026 13:19:53 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation in MemberPress Corporate Accounts WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-memberpress-privilege-escalation/Sat, 12 Sep 2026 13:19:53 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-memberpress-privilege-escalation/The MemberPress Corporate Accounts plugin for WordPress contains a mass assignment vulnerability that allows authenticated users with corporate sub-account privileges to escalate to administrator by injecting unauthorized fields during user creation.The MemberPress Corporate Accounts plugin for WordPress (versions 1.5.39 and earlier) contains a critical security flaw involving improper input validation within the 'add_sub_account_user' function. The plugin performs a mass assignment operation by passing a raw 'userdata' array directly into the 'wp_insert_user' WordPress function without sanitizing sensitive keys. This oversight allows an attacker who already possesses an authenticated account with subscriber-level access and corporate sub-account privileges to supply malicious parameters. By manipulating these parameters, an attacker can modify existing administrative accounts, such as changing their associated email addresses to gain account recovery access, or programmatically create new administrative-level accounts. This vulnerability represents a significant risk to site integrity, as it grants full control over the WordPress environment to unauthorized users.

Attack Chain

  1. Attacker authenticates to the target WordPress site with a valid subscriber account associated with a corporate sub-account.
  2. Attacker navigates to the endpoint responsible for the 'add_sub_account_user' functionality within the MemberPress Corporate Accounts plugin.
  3. Attacker intercepts the HTTP request and identifies the 'userdata' parameter structure.
  4. Attacker injects unauthorized key-value pairs into the 'userdata' payload, specifically targeting role assignment fields (e.g., 'administrator').
  5. The plugin function passes the malicious payload to 'wp_insert_user' without verifying input keys against an allowlist.
  6. The WordPress database updates or inserts the user object with the elevated permissions requested by the attacker.
  7. Attacker logs in or initiates a password reset for the newly created or hijacked administrative account to complete the full takeover of the WordPress instance.

Impact

Successful exploitation results in full administrative control over the affected WordPress installation. This allows attackers to install malicious plugins, modify site content, exfiltrate sensitive user data, and execute arbitrary code on the server if the WordPress instance has further administrative capabilities enabled. All WordPress installations running the MemberPress Corporate Accounts plugin version 1.5.39 or earlier are vulnerable.

Recommendation

  1. Upgrade the MemberPress Corporate Accounts plugin to the latest version immediately to remediate the mass assignment flaw in 'add_sub_account_user'.
  2. Audit all existing user accounts for suspicious additions or modifications to the 'administrator' role that occurred around the time of discovery.
  3. Review WordPress administrative logs for unusual user registration activity originating from the plugin's corporate sub-account interface.
]]>highadvisorywordpressprivilege-escalationvulnerability