PilotPress CVE-2026-85659

Exploitation requires an authenticated attacker holding at least a Subscriber-level PilotPress membership that maps to a valid ONTRAPORT contact, plus possession of the Customer Center nonce needed to call the update_cc_details() AJAX handler. The affected PilotPress plugin (version ≤2.0.43) must be active and configured for ONTRAPORT integration with the Customer Center feature in use. The attacker must know a target Administrator's exact WordPress login to supply as the username parameter. Limiting factors: this is not a pre-auth flaw - PR:L means a pre-existing membership account is mandatory, which constrains the attacker pool to sites that allow such registrations; UI:N means no victim interaction is needed, and the flaw triggers against the plugin's default handling once membership is obtained.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-impact artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is internally consistent with the description: a network-reachable AJAX handler, low attacker privileges (any Subscriber-level PilotPress member), no user interaction, and full compromise of an Administrator account yielding complete confidentiality/integrity/availability impact. The low-complexity rating is credible because the attack is a deterministic logic flaw (missing rollback plus an authentication guard that suppresses cookies rather than returning WP_Error) rather than a race or memory-corruption requiring special conditions. Counterbalancing signals: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced, so there is no evidence of active exploitation or weaponization yet. The practical risk is therefore 'realistic and serious but not yet observed in the wild' - the technical path to full admin takeover is clearly documented by Wordfence and the vulnerable source lines are publicly linked, which lowers the barrier to developing an exploit even though none is confirmed public. Prioritize patching, but note the exploitation requires a pre-existing authenticated PilotPress membership, which narrows the attacker population to users who already have a valid ONTRAPORT contact on the target site.

An attacker registers or already holds a low-privilege PilotPress membership (Subscriber-level) with a valid ONTRAPORT contact and obtains the Customer Center nonce. They invoke the update_cc_details() AJAX handler supplying an existing WordPress Administrator's login as the username, which renames their remote ONTRAPORT contact to that admin login even though the local collision check aborts without rolling back. On their next login using that admin username and their own password, PilotPress's wp_authenticate hook resolves the Administrator's user row, resets that account's password, and WordPress issues the attacker a full Administrator session cookie. No public exploit code is referenced, but the vulnerable source lines are publicly linked.