Content Pilot <= 2.2.4 - Authenticated (Contributor+) Missing Authorization to Campaign Configuration and Campaign Data Deletion
- ID
- WPSEC-2026-1241
- Plugin
- Content Pilot – Autoblogging & Affiliate Marketing Suite (wp-content-pilot)
- Affected
- all versions before 2.2.5
- Remediation
- Update to 2.2.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-19
- Attack surface
- Content Pilot on WPSec AttackSurface
- Fix released
- Published
Description
The Content Pilot plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the campaign settings save handler (wpcp_update_campaign_settings), the campaign reset action (wpcp_campaign_reset_search_campaign) and the delete campaign posts AJAX action (wpcp_delete_all_campaign_posts) in all versions up to, and including, 2.2.4. The campaign post type uses the standard post capabilities, so any contributor can create a campaign. The settings handler checked only edit_post, and the other actions checked only nonces that are printed on the campaign edit screen. This makes it possible for authenticated attackers, with contributor-level access and above, to configure active campaigns that run on cron and publish posts under any author, including an administrator, with any source, template and post status. Because those posts are inserted without HTML filtering, this leads to stored cross-site scripting. Attackers can also delete the post meta of arbitrary posts by ID and permanently delete posts created by other campaigns.
References
- https://wpsec.com/vuln/WPSEC-2026-1241/
- https://plugins.svn.wordpress.org/wp-content-pilot/tags/2.2.5/
- https://wordpress.org/plugins/wp-content-pilot/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS