CVE-2026-85659

The PilotPress plugin for WordPress (versions up to and including 2.0.43 ) is vulnerable to Privilege Escalation via account takeover. The flaw exists in the update_cc_details() AJAX handler, which forwards an attacker-supplied username parameter to ONTRAPORT before performing a local collision c...

EUVD-2026-102680

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the updateccdetails AJAX handler forwards an attacker-supplied username parameter to ONTRAPORT via apicall'updateccdetails'...