CVE-2026-85659 Overview
The PilotPress plugin for WordPress contains a privilege escalation flaw that allows authenticated attackers to take over Administrator accounts. The vulnerability affects all versions up to and including 2.0.43. The flaw resides in the update_cc_details() AJAX handler, which forwards an attacker-supplied username parameter to ONTRAPORT before validating against local WordPress username collisions. An attacker holding Subscriber-level access and a valid ONTRAPORT contact can rename their remote contact to match an Administrator login, then authenticate using their own password to receive an Administrator session cookie.
Critical Impact
Any authenticated PilotPress member can take full control of a WordPress Administrator account, resulting in complete site compromise.
Affected Products
- PilotPress plugin for WordPress — all versions ≤ 2.0.43
- WordPress sites using ONTRAPORT integration via PilotPress
- Sites exposing the Customer Center nonce to Subscriber-level users
Discovery Timeline
- 2026-10-16 - CVE-2026-85659 published to the National Vulnerability Database
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-85659
Vulnerability Analysis
The vulnerability is a privilege escalation issue classified under [CWE-269: Improper Privilege Management]. It stems from a logic flaw in how PilotPress synchronizes WordPress user state with the ONTRAPORT customer relationship management platform. The plugin trusts attacker-controlled input to drive remote-state mutations before enforcing local safety checks, and it fails to roll back those mutations when collision checks subsequently fail.
The attacker needs only Subscriber-level WordPress access, a valid ONTRAPORT contact, and the Customer Center nonce. These prerequisites are typical for any PilotPress membership site. The outcome is full Administrator takeover, which permits plugin installation, content modification, and arbitrary PHP execution on the host.
Root Cause
The update_cc_details() AJAX handler calls api_call('update_cc_details', ...) to rename the ONTRAPORT contact before performing the local username_exists() collision check. When a collision is detected, the handler aborts the request without issuing a compensating API call to revert the remote rename. The remote ONTRAPORT contact is now permanently associated with the login name of an existing WordPress Administrator.
A second logic flaw amplifies the issue. The user_login() function hooked into wp_authenticate resolves the local user row through get_user_by('login', $username) after a successful ONTRAPORT authentication, then calls wp_set_password() against that resolved user ID. The user_level != 10 guard only suppresses PilotPress's own cookie issuance rather than returning a WP_Error to core, so WordPress continues the authentication flow and issues a standard Administrator session cookie.
Attack Vector
The attack is remote and requires only low-privilege authenticated access. An attacker first renames their ONTRAPORT contact to match the target Administrator's WordPress login by invoking the update_cc_details AJAX endpoint with a colliding username. The local collision check fires and the handler aborts, but the remote rename persists. The attacker then submits a normal WordPress login form with the Administrator's username and the attacker's own ONTRAPORT password. PilotPress authenticates the credentials against ONTRAPORT, overwrites the Administrator's local password hash via wp_set_password(), and WordPress validates the newly-synchronized hash and issues the Administrator session cookie.
No exploitation code is published alongside the advisory. Technical details are available in the Wordfence Vulnerability Analysis and the referenced WordPress Changeset #3737004.
Detection Methods for CVE-2026-85659
Indicators of Compromise
- POST requests to admin-ajax.php with action=update_cc_details originating from Subscriber-level accounts, especially where the username parameter matches a known Administrator login.
- Unexpected password changes on Administrator accounts without a corresponding password-reset email trigger.
- Successful WordPress logins to Administrator accounts from source IPs previously associated only with Subscriber sessions.
- New plugin installations, theme edits, or user role changes performed shortly after a suspicious update_cc_details request.
Detection Strategies
- Audit the WordPress wp_users table for user_pass hash changes on accounts with user_level = 10 and correlate against ONTRAPORT API activity logs.
- Inspect webserver logs for admin-ajax.php calls carrying the update_cc_details action and compare the submitted username value against the current Administrator list.
- Review ONTRAPORT contact audit history for recent rename events where the new value matches any WordPress Administrator login.
Monitoring Recommendations
- Enable WordPress audit logging for user authentication, password change, and role change events.
- Alert on any wp_set_password() invocation that targets an Administrator user ID outside of the standard password-reset flow.
- Monitor Subscriber-level session activity for calls to Customer Center AJAX endpoints followed by Administrator login attempts within a short time window.
How to Mitigate CVE-2026-85659
Immediate Actions Required
- Update the PilotPress plugin to a version newer than 2.0.43 that incorporates the fix shipped in WordPress Changeset #3737004.
- Force a password reset for all Administrator accounts on affected WordPress sites.
- Invalidate all active WordPress authentication cookies by rotating the AUTH_KEY and SECURE_AUTH_KEY secrets in wp-config.php.
- Review the ONTRAPORT contact database for contacts whose login name matches any current WordPress Administrator.
Patch Information
The PilotPress maintainers released a fix in the commit referenced by WordPress Changeset #3737004. Site operators should upgrade through the WordPress plugin updater or by replacing the plugin files with the patched release. Review the Wordfence Vulnerability Analysis for complete remediation guidance.
Workarounds
- Temporarily deactivate the PilotPress plugin until the patched version can be deployed.
- Restrict access to admin-ajax.php for Subscriber-level users via a web application firewall rule that blocks the update_cc_details action.
- Enforce multi-factor authentication on all Administrator accounts so a stolen password alone cannot complete the login flow.
- Rename default Administrator accounts to unpredictable values that attackers cannot easily enumerate as rename targets.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
