---
id: "CVE-2026-85659"
kind: "vulnerability"
aliases: ["CVE-2026-85659"]
title: "PilotPress WordPress plugin: subscriber takes over an Administrator account"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ontraprort", "package", "pilotpress", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-version-2.0.44-or-later"]
published_at: "2026-10-16T06:17:11+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-23T22:34:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85659", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# PilotPress WordPress plugin: subscriber takes over an Administrator account

Any PilotPress member with a valid ONTRAPORT contact can rename that contact to an existing administrator's login. A later login with the attacker's own password then sets the administrator's password and returns an administrator session cookie.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check whether the PilotPress plugin is installed and its version is 2.0.43 or lower, for example with 'wp plugin list' or the Plugins screen.

## Fix

Update PilotPress to a version later than 2.0.43; unknown whether a patched version exists in the sources. Until then, deactivate the plugin and reset administrator passwords.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85659

## From the sources

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_