WordPress MemberPress Plugin Privilege Escalation via Mass Assignment

The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The MemberPress Corporate Accounts plugin for WordPress contains a critical privilege escalation vulnerability (CVE-2026-15451, CVSS 8.8) stemming from improper input validation in the 'add_sub_account_user' function. This mass assignment flaw allows authenticated subscribers with corporate account privileges to inject arbitrary user data—including administrative roles and user IDs—directly into WordPress user creation functions without sanitization. Any organization using MemberPress versions up to 1.5.39 faces immediate risk, as attackers can silently elevate their privileges to administrator level or compromise existing admin accounts, granting them full platform control and enabling lateral movement across the WordPress infrastructure.

Casky's 224 matched security skills leverage Claude AI's extended reasoning to identify this attack pattern as part of MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky will observe findings that correlate suspicious user creation events with abnormal role assignments, detect mass assignment indicators through parameter tampering analysis, and flag the specific 'userdata' array manipulation pattern. The platform's skill mapping reveals how attackers transition from subscriber-level access through unvalidated function calls to administrative control, enabling security teams to spot reconnaissance, exploitation, and post-exploitation activities before full compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-15451.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-15451

Casky has 224 skills that investigate the attack patterns behind CVE-2026-15451. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn