Vulnerability-Lookup

GHSA-PH8G-MCQH-5P98

Vulnerability from github – Published: 2026-10-16 06:30 – Updated: 2026-10-16 06:30

Details

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the update_cc_details() AJAX handler forwards an attacker-supplied username parameter to ONTRAPORT via api_call('update_cc_details', ...) before performing the local username_exists() collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, user_login() (hooked to wp_authenticate) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via get_user_by('login', $username) — which now selects the real Administrator's row — and calls wp_set_password() against that Administrator's user ID; because the user_level != 10 guard only suppresses PilotPress's own cookie issuance rather than returning a WP_Error to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-85659"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-16T06:17:11Z",
    "severity": "HIGH"
  },
  "details": "The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call(\u0027update_cc_details\u0027, ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected \u2014 leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator\u0027s login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker\u0027s own password, resolves the local WordPress user row via `get_user_by(\u0027login\u0027, $username)` \u2014 which now selects the real Administrator\u0027s row \u2014 and calls `wp_set_password()` against that Administrator\u0027s user ID; because the `user_level != 10` guard only suppresses PilotPress\u0027s own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above \u2014 specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce \u2014 to fully take over an Administrator account.",
  "id": "GHSA-ph8g-mcqh-5p98",
  "modified": "2026-10-16T06:30:28Z",
  "published": "2026-10-16T06:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85659"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1029"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1099"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1690"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L2380"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3737004"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ceee48dd-72a7-49c3-90d5-7af1a30f9ecb?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-85659 (GCVE-0-2026-85659)

Vulnerability from cvelistv5 – Published: 2026-10-16 05:30 – Updated: 2026-10-16 14:28

Title

PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter

Summary

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above — specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce — to fully take over an Administrator account.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-16 14:27 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2313 records in the last 180 days details

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/pilotp…
https://plugins.trac.wordpress.org/browser/pilotp…
https://plugins.trac.wordpress.org/browser/pilotp…
https://plugins.trac.wordpress.org/browser/pilotp…
https://plugins.trac.wordpress.org/changeset/3737004

Impacted products

1 product

Vendor	Product	Version
ontraport	PilotPress	Affected: 0 , ≤ 2.0.43 (semver)

Credits

Supakiad S. (m3ez)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85659",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T14:27:54.578795Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T14:28:39.370Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PilotPress",
          "vendor": "ontraport",
          "versions": [
            {
              "lessThanOrEqual": "2.0.43",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Supakiad S. (m3ez)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call(\u0027update_cc_details\u0027, ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected \u2014 leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator\u0027s login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker\u0027s own password, resolves the local WordPress user row via `get_user_by(\u0027login\u0027, $username)` \u2014 which now selects the real Administrator\u0027s row \u2014 and calls `wp_set_password()` against that Administrator\u0027s user ID; because the `user_level != 10` guard only suppresses PilotPress\u0027s own cookie issuance rather than returning a `WP_Error` to core, WordPress proceeds to validate the newly-synchronized password and issues a full Administrator authentication cookie to the attacker. This makes it possible for authenticated attackers with Subscriber-level access and above \u2014 specifically any PilotPress member holding a valid ONTRAPORT contact and the Customer Center nonce \u2014 to fully take over an Administrator account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T05:30:27.472Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ceee48dd-72a7-49c3-90d5-7af1a30f9ecb?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L2380"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1690"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1029"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/pilotpress/tags/2.0.39/pilotpress.php?rev=3642310#L1099"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3737004"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T16:30:23.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "PilotPress \u003c= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via \u0027username\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-85659",
    "datePublished": "2026-10-16T05:30:27.472Z",
    "dateReserved": "2026-09-04T13:32:20.828Z",
    "dateUpdated": "2026-10-16T14:28:39.370Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted