IT SBIT Services
Schneeberger
DEEN
CVE tracker

PilotPress WordPress plugin: Privilege escalation via account takeover

CVE-2026-85659High 8.8

← All vulnerabilities

Summary

The PilotPress plugin for WordPress up to and including version 2.0.43 allows authenticated users to take over WordPress Administrator accounts. The AJAX handler update_cc_details() renames the attacker's ONTRAPORT contact to an existing administrator login before a local collision check, and the remote rename is not rolled back. A later login with the attacker's password then sets the administrator's WordPress password and grants an administrator session. The attacker needs a valid Subscriber-level account and a PilotPress/ONTRAPORT contact.

Affected

  • PilotPress up to and including 2.0.43
  • Sites with open registration or membership features are most exposed

Fixed in

Unknown. Unconfirmed third-party information points to 2.0.44 or later; verify on the WordPress.org changelog or the Wordfence advisory before relying on it.

Workaround

  • Deactivate PilotPress until a fixed version is confirmed
  • Restrict Subscriber-level registration and review existing Subscriber accounts
  • Restrict AJAX endpoint access to users with explicit capabilities (third-party suggestion, stopgap only)
  • Enforce two-factor authentication for all administrators

Exploitation

  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total
  • Not listed in CISA KEV
  • No public proof of concept found
  • No reports of exploitation in the wild found
  • Reported by Positive Technologies; NVD status pending

Our recommendation

  • Check whether PilotPress is installed and which version is used
  • If ONTRAPORT is not actively used, remove the plugin
  • If it is used, deactivate it or restrict Subscriber-level registration until a fixed version is confirmed
  • Review administrator accounts for unexpected password changes or new admin accounts
  • Enforce 2FA for all administrators
  • Re-check NVD and the Wordfence advisory in a few days

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:07.

Original description (NVD)

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed