https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 13:33:35 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-85659 <p>The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call(&#39;update_cc_details&#39;, ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator&#39;s login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker&#39;s own password, resolves the local WordPress user row via `get_user_by(&#39;login&#39;, $username)` — which now selects the real Administrator&#39;s row — and calls `wp_set_password()` against that Administrator&#39;s user ID; because the `user_level != 10` guard only suppresses PilotPress&#39;s own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.</p> <p>The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call(&#39;update_cc_details&#39;, ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator&#39;s login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker&#39;s own password, resolves the local WordPress user row via `get_user_by(&#39;login&#39;, $username)` — which now selects the real Administrator&#39;s row — and calls `wp_set_password()` against that Administrator&#39;s user ID; because the `user_level != 10` guard only suppresses PilotPress&#39;s own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.</p> https://db.gcve.eu/vuln/fkie_cve-2026-85659 https://db.gcve.eu/vuln/ghsa-ph8g-mcqh-5p98 <p>The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call(&#39;update_cc_details&#39;, ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator&#39;s login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker&#39;s own password, resolves the local WordPress user row via `get_user_by(&#39;login&#39;, $username)` — which now selects the real Administrator&#39;s row — and calls `wp_set_password()` against that Administrator&#39;s user ID; because the `user_level != 10` guard only suppresses PilotPress&#39;s own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.</p> <p>The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call(&#39;update_cc_details&#39;, ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator&#39;s login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker&#39;s own password, resolves the local WordPress user row via `get_user_by(&#39;login&#39;, $username)` — which now selects the real Administrator&#39;s row — and calls `wp_set_password()` against that Administrator&#39;s user ID; because the `user_level != 10` guard only suppresses PilotPress&#39;s own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.</p> https://db.gcve.eu/vuln/ghsa-ph8g-mcqh-5p98