MemberPress vulnerabilities
We track 3 vulnerabilities in MemberPress products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
Latest MemberPress vulnerabilities
- 8.8 High severity
Memberpress: Cross-Site Request Forgery
The MemberPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.14.1. This is due to a bypassable nonce verification check in the save_profile_fields() function that uses an isset() condition at line 1119, a
- 8.8 High severity
MemberPress Corporate Accounts: Improper Privilege Management
The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array t
- 7.5 High severity
Memberpress: Exposure of Sensitive Information to an Unauthorized Actor
The Memberpress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.11.37 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts