CVE-2026-15451 is a privilege escalation vulnerability in the MemberPress Corporate Accounts WordPress plugin (<=1.5.39). The flaw arises from a mass assignment issue in the 'add_sub_account_user' function, which passes the raw 'userdata' array to 'wp_insert_user' without filtering sensitive keys such as 'role' or 'ID'. This allows authenticated attackers with subscriber-level access and a corporate account to escalate privileges by creating new administrator accounts or hijacking existing ones by overwriting administrator email addresses. The vulnerability was partially addressed in version 1.5.39, but the description does not confirm a complete fix.

An attacker with subscriber-level access and a corporate account can escalate privileges to administrator level, enabling full control over the WordPress site. This includes creating new administrator accounts or hijacking existing ones, leading to complete compromise of confidentiality, integrity, and availability of the affected system.

A partial patch was applied in version 1.5.39. Users should upgrade to the latest version beyond 1.5.39 once available to ensure full remediation. Until then, restrict subscriber-level access and corporate account privileges where possible. Monitor vendor advisories for updates on a complete fix. Patch status is not yet fully confirmed; check the vendor advisory for current remediation guidance.