Content Pilot CVE-2026-111070

Exploitation requires that a WordPress administrator has already set up a Content Pilot (wp-content-pilot) RSS-type campaign that consumes a feed whose article content the attacker can control, and that the campaign author is an account with the unfiltered_html capability (the default is an Administrator). The specific trigger is the HTML meta description of a remotely-fetched article (WPCP_Readability::parse_meta), which flows through template substitution and html_entity_decode in WPCP_Module::insert_post and is persisted via wp_insert_post with no wp_kses_post sanitization because the plugin switches to the privileged campaign author first. Limiting factors that reduce real-world risk: the attacker cannot act against a default install - the vulnerable path exists only once an admin configures an RSS campaign pointed at an attacker-influenceable source; the payload executes only when a user subsequently visits the generated post; and the attack is absent if the campaign author lacks unfiltered_html. This is why the CVSS carries AC:H despite PR:N.

This is a genuine but conditional, moderate-severity issue rather than a drop-everything emergency. The signals are mostly consistent: CVSS 3.1 base 5.4 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) and vuln.today's 'this_month' decision label both point to meaningful-but-not-critical priority. The AC:H is well-justified by the data - exploitation is not opportunistic against any Internet-facing instance; it requires that a site administrator has already configured a Content Pilot RSS campaign to consume a feed whose content the attacker controls. PR:N is correct in the sense that the person supplying the malicious RSS content needs no WordPress credentials. The stored payload persists with Administrator (unfiltered_html) privileges precisely because the plugin switches the current user to the campaign author before wp_insert_post(), which is the root cause of the missing wp_kses_post sanitization. No EPSS score, no KEV listing, and no PoC reference were provided in the input, so there is no evidence of active exploitation or public exploit code - exploitation status is 'no public exploit identified at time of analysis.' The main gap to flag: real-world risk hinges almost entirely on whether an admin ingests an attacker-controllable feed, a condition the raw CVSS score does not convey, so treat the 5.4 as an upper bound for most deployments.

An administrator configures a Content Pilot RSS campaign pointing at a feed the attacker can influence (for example a feed the attacker publishes, or a legitimate source the attacker can inject into). The attacker places a crafted HTML meta description containing a script payload in a fetched article; the plugin parses it via WPCP_Readability::parse_meta(), passes it through html_entity_decode() in WPCP_Module::insert_post() without wp_kses_post sanitization, and stores it as post_content under an Administrator author. The script then executes in the browser of any visitor who views the auto-generated page. No public exploit code was identified in the provided data.