WordPress PilotPress Plugin Privilege Escalation via Account Takeover

The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43. The vulnerability exists because the `update_cc_details()` AJAX handler forwards an attacker-supplied `username` parameter to ONTRAPORT via `api_call('update_cc_details', ...)` before performing the local `username_exists()` collision check, and aborts without rolling back the remote rename when a collision is detected — leaving the remote ONTRAPORT contact renamed to an existing WordPress Administrator's login. On a subsequent login attempt, `user_login()` (hooked to `wp_authenticate`) authenticates against ONTRAPORT using the renamed login and the attacker's own password, resolves the local WordPress user row via `get_user_by('login', $username)` — which now selects the real Administrator's row — and calls `wp_set_password()` against that Administrator's user ID; because the `user_level != 10` guard only suppresses PilotPress's own cookie issuan

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The PilotPress plugin for WordPress (versions up to 2.0.43) contains a critical privilege escalation vulnerability that allows attackers to hijack user accounts through a race condition in the AJAX `update_cc_details()` handler. The flaw stems from premature API calls to ONTRAPORT before local validation checks complete—when a username collision is detected, the plugin aborts without rolling back the remote account rename, permanently transferring the compromised account to the attacker. This affects any WordPress site running the vulnerable plugin with ONTRAPORT integration, potentially exposing sensitive payment card details and administrative access. With a CVSS score of 8.8, this represents a high-severity threat to e-commerce and membership-based WordPress deployments.

Casky's 224 matched security skills leverage Claude's extended reasoning to map this vulnerability across MITRE ATT&CK's Privilege Escalation technique (TA0004), detecting attack chains that include credential compromise, account manipulation, and persistence establishment. Practitioners using Casky would observe findings highlighting improper input validation (CWE-269 context), race condition exploitation patterns, insecure API call sequencing, and insufficient transaction atomicity in the plugin's authentication flow. The platform's skill correlation would surface related defensive techniques such as API call validation sequencing, local-before-remote verification workflows, transaction rollback mechanisms, and anomalous account rename activities in third-party service logs—enabling teams to identify both vulnerable deployments and active exploitation attempts in their environment.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85659.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-85659

Casky has 224 skills that investigate the attack patterns behind CVE-2026-85659. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn