Privilege Escalation Vulnerability in PilotPress Plugin for WordPress

CVE-2026-85659

What is CVE-2026-85659?

The PilotPress plugin for WordPress is susceptible to a privilege escalation vulnerability that allows authenticated users, specifically those with Subscriber-level access and above, to assume the role of an Administrator. This occurs through an exploited AJAX handler that incorrectly processes a supplied username parameter, neglecting to properly validate it before interfacing with external systems like ONTRAPORT. The flaw permits attackers to manipulate account details and ultimately gain unauthorized administrative access by hijacking the authentication process. Users are urged to update to the latest version to mitigate this risk.

References