# Content Pilot <= 2.2.4 - Authenticated (Contributor+) Missing Authorization to Campaign Configuration and Campaign Data Deletion

- **ID:** WPSEC-2026-1241
- **Plugin:** Content Pilot – Autoblogging & Affiliate Marketing Suite (`wp-content-pilot`), https://wordpress.org/plugins/wp-content-pilot/
- **Affected versions:** all versions before 2.2.5
- **Fixed in:** 2.2.5 (Update to 2.2.5 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-19)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-content-pilot
- **Fix released:** 2026-10-18
- **Published:** 2026-10-19
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1241/

## Description

The Content Pilot plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the campaign settings save handler (wpcp_update_campaign_settings), the campaign reset action (wpcp_campaign_reset_search_campaign) and the delete campaign posts AJAX action (wpcp_delete_all_campaign_posts) in all versions up to, and including, 2.2.4. The campaign post type uses the standard post capabilities, so any contributor can create a campaign. The settings handler checked only edit_post, and the other actions checked only nonces that are printed on the campaign edit screen. This makes it possible for authenticated attackers, with contributor-level access and above, to configure active campaigns that run on cron and publish posts under any author, including an administrator, with any source, template and post status. Because those posts are inserted without HTML filtering, this leads to stored cross-site scripting. Attackers can also delete the post meta of arbitrary posts by ID and permanently delete posts created by other campaigns.

## References

- https://wpsec.com/vuln/WPSEC-2026-1241/
- https://plugins.svn.wordpress.org/wp-content-pilot/tags/2.2.5/
- https://wordpress.org/plugins/wp-content-pilot/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1241/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.