THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-15451 (HIGH 8.8) — The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' w

[NVD] CVE-2026-15451 (HIGH 8.8) — The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' w

mednvdPublished 2026-09-12

CVE-2026-15451 CVSS: 8.8 HIGH Published: 2026-09-12T13:16:50.940

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This

MITRE ATT&CK techniques

Email AddressesT1589.002

Indicators of compromise

CVE-2026-15451cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-15451