CVE-2026-85659: CWE-269 Improper Privilege Management in ontraport PilotPress

CVE-2026-85659 is a privilege escalation vulnerability in the PilotPress WordPress plugin (versions up to 2.0.43). The issue arises because the update_cc_details AJAX handler forwards an attacker-supplied username to Ontraport's API before verifying username collisions locally. If a collision is detected, the remote rename is not rolled back, causing the Ontraport contact to be renamed to an existing WordPress Administrator's login. On subsequent login, the plugin authenticates against Ontraport using the renamed login and attacker’s password, then synchronizes the password to the Administrator's WordPress account. Although a user_level check suppresses PilotPress's own cookie issuance, WordPress itself validates the new password and issues a full Administrator authentication cookie, enabling full account takeover by users with Subscriber-level access or above who have a valid Ontraport contact and Customer Center nonce.

An authenticated user with Subscriber-level access or higher can fully take over any Administrator account on the affected WordPress site. This includes gaining complete control over the site, potentially leading to data compromise, site defacement, or further malicious activity. The vulnerability has a high CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to users with Subscriber-level or higher privileges and monitor for suspicious activity related to account renaming or authentication. Avoid exposing the update_cc_details AJAX handler to untrusted users if possible.