CVE-2026-104749: Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because IntegrationHandler::executeWithCapture() stores raw, attacker-controlled field values — including userpass and useremail — verbatim into wpbtcbilog.fielddata on anonymous front-end requests with no capability check, and LogHandler::reexecute() feeds that stored payload back through Flow::execute() inside the replaying administrator's session without validating the identity that originally produced the data, causing RegistrationController::updateUser() to resolve the target user ID to the administrator and write the attacker-supplied password via wpupdateuser(). This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the userpass parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.
Affected Software
Event History
Frequently Asked Questions
What configuration makes a site susceptible to this issue?
The affected flow must map a user-supplied form field to the user_pass parameter of the WP User Registration “Update User” action. Without that mapping, the described password-overwrite path is not present.
Does an attacker need a WordPress account to submit the malicious data?
No. The vulnerable path captures attacker-controlled field values from anonymous front-end requests without a capability check.
What administrator action is needed for account takeover?
A stored log payload must be re-executed by an administrator. The replay runs through the administrator’s session and can cause the attacker-supplied password to be written to the administrator account.
What can be checked for signs of exposure or attempted exploitation?
Review the wp_btcbi_log.field_data data for anonymous-captured entries containing fields such as user_pass or user_email. Also review configured registration-update flows for mappings from user-controlled fields to user_pass.
What can be done if an update is not immediately available?
Remove or avoid any flow mapping that sends a user-controlled form field to user_pass in the WP User Registration “Update User” action. Do not re-execute relevant stored logs while that configuration remains in place.