{"id":"CVE-2026-85659","kind":"vulnerability","aliases":["CVE-2026-85659"],"related":[],"title":"PilotPress WordPress plugin: subscriber takes over an Administrator account","description":"The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.","summary":"Any PilotPress member with a valid ONTRAPORT contact can rename that contact to an existing administrator's login. A later login with the attacker's own password then sets the administrator's password and returns an administrator session cookie.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ontraprort","package","pilotpress","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-2.0.44-or-later"],"how_to_check":"Check whether the PilotPress plugin is installed and its version is 2.0.43 or lower, for example with 'wp plugin list' or the Plugins screen.","fix":"Update PilotPress to a version later than 2.0.43; unknown whether a patched version exists in the sources. Until then, deactivate the plugin and reset administrator passwords.","status":"open","published_at":"2026-10-16T06:17:11+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:34:55+00:00","updated_at":"2026-10-23T22:34:55+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:34:55Z","model":"claude-haiku-5-5","output":{"fix":"Update PilotPress to a version later than 2.0.43; unknown whether a patched version exists in the sources. Until then, deactivate the plugin and reset administrator passwords.","reach":"internet","title":"PilotPress WordPress plugin: subscriber takes over an Administrator account","impact":"high","summary":"Any PilotPress member with a valid ONTRAPORT contact can rename that contact to an existing administrator's login. A later login with the attacker's own password then sets the administrator's password and returns an administrator session cookie.","category":"package","who_cares":["wordpress","pilotpress","ontraprort"],"confidence":0.8,"needs_auth":"yes","worst_case":"attacker gets a full Administrator login on the WordPress site","analyst_note":"Confirm the first patched PilotPress version and whether the plugin's ONTRAPORT integration is required for the exploit path; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-85659.","how_to_check":"Check whether the PilotPress plugin is installed and its version is 2.0.43 or lower, for example with 'wp plugin list' or the Plugins screen.","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-2.0.44-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000571,"input_tokens":3291,"output_tokens":484,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-85659':12A,15A '10':198C '2.0.43':79C 'abort':114C 'access':245C 'account':9A,70C,268C 'administr':8A,35B,50B,56B,136C,180C,190C,228C,267C 'ajax':88C 'api':100C 'attack':43B,93C,159C,233C,240C 'attacker-suppli':92C 'attempt':143C 'authent':149C,150C,229C,239C 'back':117C 'call':101C,184C 'cc':86C,103C 'center':260C 'check':112C 'collis':111C,123C 'contact':27B,31B,130C,256C 'cooki':58B,205C,230C 'core':214C 'custom':259C 'cve':10A,13A 'detail':87C,104C 'detect':125C 'error':212C 'escal':68C 'exist':34B,82C,110C,134C 'forward':90C 'full':227C 'fulli':263C 'get':170C 'guard':199C 'handler':89C 'hold':252C 'hook':146C 'id':193C 'includ':78C 'issu':225C 'issuanc':206C 'later':39B 'leav':126C 'level':197C,244C 'local':108C,165C 'login':37B,40B,138C,142C,145C,156C,173C 'make':235C 'member':22B,251C 'newli':221C 'newly-synchron':220C 'nonc':261C 'ontraport':26B,98C,129C,152C,255C 'ontraprort':16B 'packag':17B 'paramet':96C 'password':46B,52B,162C,187C,223C 'perform':106C 'pilotpress':1A,18B,21B,60C,202C,250C 'plugin':3A,61C 'possibl':237C 'privileg':67C 'proceed':216C 'rather':207C 'real':179C 'remot':119C,128C 'renam':29B,120C,131C,155C 'resolv':163C 'return':54B,209C 'roll':116C 'row':168C,182C 'select':177C 'session':57B 'set':48B,186C 'specif':248C 'subscrib':4A,243C 'subscriber-level':242C 'subsequ':141C 'suppli':94C 'suppress':201C 'synchron':222C 'take':5A,264C 'takeov':71C 'updat':85C,102C 'use':153C 'user':144C,167C,171C,192C,196C 'usernam':95C,109C,174C 'valid':25B,218C,254C 'version':74C 'via':69C,99C,169C 'vulner':65C,81C 'without':115C 'wordpress':2A,19B,63C,135C,166C,215C 'wp':148C,185C,211C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T06:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85659","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85659","severity":null,"published_at":"2026-10-16T06:17:11+00:00","modified_at":"2026-10-16T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}