PilotPress vulnerabilities

The PilotPress plugin for WordPress (versions up to and including 2.0.43) is vulnerable to privilege escalation via account takeover. The update_cc_details() AJAX handler forwards an attacker-supplied username to ONTRAPORT before the local username_exists() collision check, and aborts without rolling back the remote rename when a collision is detected, allowing an authenticated Subscriber-level attacker to take over an Administrator account.

The PilotPress plugin for WordPress (versions up to and including 2.0.36) contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script can be persistently stored and executed in the user's browser.

Missing Authorization vulnerability in PilotPress (versions up to 2.0.36) allows exploiting incorrectly configured access control security levels.