{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pilotpress--2.0.43/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pilotpress:pilotpress:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-85659"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PilotPress (\u003c= 2.0.43)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","vulnerability"],"_cs_type":"advisory","_cs_vendors":["PilotPress"],"content_html":"\u003cp\u003eThe PilotPress plugin for WordPress, in versions up to and including 2.0.43, is vulnerable to a privilege escalation attack that leads to full administrative account takeover. The flaw exists within the update_cc_details() AJAX handler. When an attacker-supplied username is submitted, the plugin forwards the request to the ONTRAPORT service via an API call before verifying if the username already exists locally within the WordPress database. If a collision is detected, the plugin fails to roll back the remote change on the ONTRAPORT service, resulting in a misaligned state where the remote contact is linked to an existing WordPress administrator account. This vulnerability allows an authenticated attacker with at least Subscriber-level access to synchronize their own password with an administrator account, ultimately resulting in the issuance of an administrative authentication cookie by the WordPress core.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the target WordPress site with a valid Subscriber-level account and obtains a valid Customer Center nonce.\u003c/li\u003e\n\u003cli\u003eAttacker invokes the \u003ccode\u003eupdate_cc_details()\u003c/code\u003e AJAX handler, providing a \u003ccode\u003eusername\u003c/code\u003e parameter that matches an existing WordPress Administrator login.\u003c/li\u003e\n\u003cli\u003eThe plugin executes \u003ccode\u003eapi_call('update_cc_details', ...)\u003c/code\u003e to the ONTRAPORT service, successfully renaming the remote contact.\u003c/li\u003e\n\u003cli\u003eThe plugin subsequently identifies a local collision via \u003ccode\u003eusername_exists()\u003c/code\u003e but fails to revert the change made in step 3.\u003c/li\u003e\n\u003cli\u003eAttacker attempts to log in using the targeted Administrator's username and the attacker's own password.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003euser_login()\u003c/code\u003e hook triggers \u003ccode\u003ewp_authenticate\u003c/code\u003e, validating credentials against ONTRAPORT.\u003c/li\u003e\n\u003cli\u003eThe system retrieves the local administrator's user row via \u003ccode\u003eget_user_by('login', $username)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003ewp_set_password()\u003c/code\u003e is executed against the Administrator's user ID, granting the attacker a full administrative session.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-85659 allows an attacker with low-privileged access (e.g., Subscriber) to escalate privileges to Administrator. This grants the attacker full control over the WordPress instance, including the ability to install malicious plugins, modify content, extract sensitive database information, or execute arbitrary code on the server, potentially leading to a full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the PilotPress plugin to the latest version, ensuring the installation is patched beyond version 2.0.43.\u003c/li\u003e\n\u003cli\u003eAudit WordPress user activity logs for suspicious account modifications or unexpected changes in administrator-level access.\u003c/li\u003e\n\u003cli\u003eReview administrative user accounts for recent password changes that do not correspond with known authorized administrative actions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:28:37Z","date_published":"2026-10-16T06:28:37Z","id":"https://feed.craftedsignal.io/briefs/2026-10-pilotpress-privilege-escalation/","summary":"The PilotPress WordPress plugin (\u003c= 2.0.43) contains a logic flaw in the update_cc_details() AJAX handler that allows an authenticated attacker to trigger an administrative account takeover.","title":"PilotPress Plugin for WordPress Privilege Escalation via Account Takeover","url":"https://feed.craftedsignal.io/briefs/2026-10-pilotpress-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - PilotPress (\u003c= 2.0.43)","version":"https://jsonfeed.org/version/1.1"}