A critical privilege escalation vulnerability in the MemberPress Corporate Accounts plugin for WordPress allows authenticated attackers to gain administrative control over the application.

This is a mass assignment flaw in the add_sub_account_user function that fails to filter sensitive keys during user creation. Authenticated users with subscriber-level access or higher can exploit this to create new administrator accounts or hijack existing ones.

The ability for a standard user to escalate their privileges to an administrative level poses an extreme risk to business operations. A successful compromise grants the attacker full control over the WordPress environment, leading to potential data exfiltration, unauthorized site configuration changes, and complete system takeover. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: Update the MemberPress Corporate Accounts plugin to version 1.6.0 or higher immediately to apply the necessary security patches.

Proactive Monitoring: Monitor user account creation logs and administrative audit trails for suspicious activity or the unauthorized addition of new administrator accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious requests targeting the add_sub_account_user endpoint.

Public Exploit Available: Unknown

Given the severity of this privilege escalation vulnerability, administrators must prioritize updating the MemberPress Corporate Accounts plugin to version 1.6.0. Allowing this flaw to remain unpatched exposes the entire WordPress site to total administrative compromise. Ensure that all plugin updates are verified against the vendor's official release notes and perform a post-update audit of administrative user accounts to ensure no unauthorized access has already occurred.