Skip to content
OpenAdvisories

Vendor

MemberPress

7 known vulnerabilities.

Products

Memberpress 6 MemberPress Corporate Accounts 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-92797

    Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter

    The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, …

    MemberPress Memberpress Web / CMS
  • High 8.8
    CVE-2026-15451

    MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation

    The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array …

    MemberPress MemberPress Corporate Accounts Web / CMS
  • High 8.5
    CVE-2024-5031

    MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode

    The Memberpress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.11.29 via the 'mepr-user-file' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and abo…

    MemberPress Memberpress Web / CMS