CVE-2026-15451: The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in vulnerability

What happened

A security weakness in The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in is being tracked as CVE-2026-15451. The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1 5 39. The affected release boundary in the available advisory material is up to, and including, 1.5.39. This is due to The MemberPress Corporate Accounts plugin for WordPress; teams should compare that boundary with the versions actually running in production.

The flaw is best understood as a privilege-escalation weakness, rather than simply as a CVE number or severity score. If the published conditions are met, the security consequence is higher privileges than intended. CVE-2026-15451 currently carries a HIGH 8 8 severity signal in the retained vulnerability data.

The important point is that running an affected version of The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in creates exposure, while an actual compromise still depends on whether the attacker can reach the trigger conditions described above. This is due to The MemberPress Corporate Accounts plugin for WordPress as affected versions.

The affected versions identified in the advisory are up to, and including, 1 5 39. The available advisory information identifies up to, and including, 1 5 39. The issue currently carries a HIGH 8 8 severity signal in the CyberDeltaForce record.

The current severity signal is HIGH 8 8. The operational question is not simply the severity score, but whether the affected component is deployed, reachable, business-critical and protected by compensating controls. Real risk depends on exposure, exploitability, compensating controls and the importance of the affected asset—not the CVSS number alone.

This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. Inventory the affected product deployments and confirm whether the affected component and vulnerable release are present. Apply the vendor patch or mitigation for CVE-2026-15451 and validate the affected path after remediation.

The current source set does not report active exploitation of CVE-2026-15451; that status should be monitored rather than treated as proof that exploitation is impossible. The most useful validation after remediation is to confirm that the vulnerable path no longer permits the reported behavior and that the deployed release matches the vendor's corrected version.

So far, researchers have not reported exploitation, but that can change as vendor, government or threat-intelligence reporting develops.