PilotPress Plugin for WordPress Privilege Escalation via Account Takeover

The PilotPress plugin for WordPress, in versions up to and including 2.0.43, is vulnerable to a privilege escalation attack that leads to full administrative account takeover. The flaw exists within the update_cc_details() AJAX handler. When an attacker-supplied username is submitted, the plugin forwards the request to the ONTRAPORT service via an API call before verifying if the username already exists locally within the WordPress database. If a collision is detected, the plugin fails to roll back the remote change on the ONTRAPORT service, resulting in a misaligned state where the remote contact is linked to an existing WordPress administrator account. This vulnerability allows an authenticated attacker with at least Subscriber-level access to synchronize their own password with an administrator account, ultimately resulting in the issuance of an administrative authentication cookie by the WordPress core.

Attack Chain

1. Attacker authenticates to the target WordPress site with a valid Subscriber-level account and obtains a valid Customer Center nonce.
2. Attacker invokes the update_cc_details() AJAX handler, providing a username parameter that matches an existing WordPress Administrator login.
3. The plugin executes api_call('update_cc_details', ...) to the ONTRAPORT service, successfully renaming the remote contact.
4. The plugin subsequently identifies a local collision via username_exists() but fails to revert the change made in step 3.
5. Attacker attempts to log in using the targeted Administrator's username and the attacker's own password.
6. The user_login() hook triggers wp_authenticate, validating credentials against ONTRAPORT.
7. The system retrieves the local administrator's user row via get_user_by('login', $username).
8. wp_set_password() is executed against the Administrator's user ID, granting the attacker a full administrative session.

Impact

Successful exploitation of CVE-2026-85659 allows an attacker with low-privileged access (e.g., Subscriber) to escalate privileges to Administrator. This grants the attacker full control over the WordPress instance, including the ability to install malicious plugins, modify content, extract sensitive database information, or execute arbitrary code on the server, potentially leading to a full system compromise.

Recommendation

• Immediately update the PilotPress plugin to the latest version, ensuring the installation is patched beyond version 2.0.43.
• Audit WordPress user activity logs for suspicious account modifications or unexpected changes in administrator-level access.
• Review administrative user accounts for recent password changes that do not correspond with known authorized administrative actions.