4 matches found
CVE-2026-85659
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the updateccdetails AJAX handler forwards an attacker-supplied username parameter to ONTRAPORT via apicall'updateccdetails'...
CVE-2026-85659 PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the updateccdetails AJAX handler forwards an attacker-supplied username parameter to ONTRAPORT via apicall'updateccdetails'...
CVE-2026-85659
The PilotPress plugin for WordPress (versions up to and including 2.0.43 ) is vulnerable to Privilege Escalation via account takeover. The flaw exists in the update_cc_details() AJAX handler, which forwards an attacker-supplied username parameter to ONTRAPORT before performing a local collision c...
EUVD-2026-102680
The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the updateccdetails AJAX handler forwards an attacker-supplied username parameter to ONTRAPORT via apicall'updateccdetails'...