CVE-2025-58221
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Missing Authorization vulnerability in PilotPress (versions up to 2.0.36) allows exploiting incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may exploit the missing authorization to perform unauthorized actions, potentially leading to data security breaches.
Recommendation
Update PilotPress to a patched version or properly configure access control.
Other vulnerabilities in PilotPress
See all- CVE-2026-85659High
The PilotPress plugin for WordPress (versions up to and including 2.0.43) is vulnerable to privilege escalation via account takeover. The update_cc_details() AJAX handler forwards an attacker-supplied username to ONTRAPORT before the local username_exists() collision check, and aborts without rolling back the remote rename when a collision is detected, allowing an authenticated Subscriber-level attacker to take over an Administrator account.
- CVE-2025-58238Medium
The PilotPress plugin for WordPress (versions up to and including 2.0.36) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.
Original NVD description (English source)
Missing Authorization vulnerability in ONTRAPORT PilotPress pilotpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PilotPress: from n/a through <= 2.0.36.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS