The PilotPress plugin for WordPress contains a CWE-269 (Broken Access Control) flaw that allows an authenticated user with Subscriber-level access or higher to gain Administrator privileges. The vulnerability occurs when the update_cc_details AJAX handler forwards an attacker‑supplied username to ONTRAPORT before performing a local collision check, and does not roll back the remote rename when a collision is detected. This results in the remote ONTRAPORT contact being renamed to an existing WordPress Administrator's login. On the next login attempt, WordPress authenticates against ONTRAPORT using the renamed login and the attacker’s password, resolves the local user row for the real administrator, and sets the administrator’s password to the attacker’s, thereby granting full administrator access.

Affected vendors include Ontraport, specifically the PilotPress plugin for WordPress. The vulnerability is present in all releases up to and including version 2.0.43. Users running any of these versions, particularly those with valid ONTRAPORT contacts and the required Customer Center nonce, are at risk.

The CVSS score is 8.8, indicating a high‑severity vulnerability. The EPSS score is 0.00367 (approximately 0.4%), indicating a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated attacker possessing Subscriber-level or higher privileges who can supply a valid ONTRAPORT username and nonce. The attacker can then trigger the account takeover process and obtain an administrator cookie without re‑authentication, leading to full site compromise.