CVE-2026-104749: Bit Integrations Plugin Privilege Escalation

CVE-2026-104749 Overview

CVE-2026-104749 affects the Bit Integrations plugin for WordPress, which provides form integration, webhook, spreadsheet, CRM, LMS, and email automation workflows. The vulnerability allows unauthenticated attackers to overwrite an administrator's password by submitting crafted form data that is later re-executed from the plugin's log screen. The flaw stems from a missing identity check in the log replay path, which causes the stored attacker payload to be applied against the administrator's own account. All versions through 2.10.6 are affected. Exploitation is tracked under CWE-269: Improper Privilege Management.

Critical Impact
Successful exploitation allows an unauthenticated attacker to take over the WordPress administrator account, resulting in full site compromise.

Affected Products

Bit Integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress
All versions up to and including 2.10.6
WordPress sites with a flow mapping a user-supplied form field to the user_pass parameter of the WP User Registration "Update User" action

Discovery Timeline

2026-10-14 - CVE-2026-104749 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104749

Vulnerability Analysis

The vulnerability is a privilege escalation flaw in the Bit Integrations plugin's integration logging and replay logic. The IntegrationHandler::executeWithCapture() function stores raw, attacker-controlled field values from anonymous front-end submissions into the wp_btcbi_log.field_data table. No capability check is enforced at the capture stage, so values including user_pass and user_email are persisted verbatim.

When an administrator later reviews failed integrations and clicks "Re-execute" on a log row, LogHandler::reexecute() feeds the stored payload back through Flow::execute() within the administrator's authenticated session. The replay path does not validate the identity that originally submitted the data. As a result, RegistrationController::updateUser() resolves the target user ID to the logged-in administrator and calls wp_update_user() with the attacker-supplied password.

Root Cause

The root cause is a trust boundary violation between unauthenticated input capture and authenticated replay. The log replay function treats stored anonymous input as if it had been produced by the administrator triggering the re-execution, discarding the original request context.

Attack Vector

An unauthenticated attacker submits a form that triggers a configured Bit Integrations flow mapped to WP User Registration's "Update User" action. The attacker includes a chosen user_pass value in the submission. The submission fails and is recorded in the plugin's log. When an administrator subsequently clicks "Re-execute" on the failure row from the plugin's log screen, the stored password payload is written to the administrator's own account via wp_update_user(), allowing full account takeover.

For implementation specifics, see the RegistrationController source, the IntegrationHandler source, and the LogHandler source.

Detection Methods for CVE-2026-104749

Indicators of Compromise

Rows in the wp_btcbi_log table containing user_pass or user_email fields in field_data originating from anonymous front-end submissions.
Unexpected wp_update_user() events for administrator accounts shortly after an admin clicks "Re-execute" in the Bit Integrations log screen.
Administrator password reset events with no corresponding user-initiated workflow in WordPress audit logs.
Unexplained administrator session logins from new IP addresses following plugin log activity.

Detection Strategies

Audit the Bit Integrations log table for stored payloads containing credential-related keys such as user_pass, user_email, or user_login.
Monitor WordPress action logs for profile_update and password_reset hooks firing from the plugin's replay code path.
Correlate administrator authentication events with recent plugin log re-execution activity.

Monitoring Recommendations

Enable WordPress audit logging for user profile and role changes and forward events to a central SIEM for correlation.
Alert on new administrator sessions originating from IP addresses not previously seen for that account.
Review all Bit Integrations flows mapping form fields to WP User Registration "Update User" actions and flag any mapping to user_pass.

How to Mitigate CVE-2026-104749

Immediate Actions Required

Update the Bit Integrations plugin to a version later than 2.10.6 that includes the fix from the plugin changeset 3730118.
Do not click "Re-execute" on any Bit Integrations log row produced by anonymous front-end submissions until the plugin is patched.
Review all configured flows and remove any mapping of a user-supplied form field to the user_pass parameter of the WP User Registration "Update User" action.
Rotate administrator passwords and invalidate active sessions if suspicious log replay activity is detected.

Patch Information

The vendor patch is available through the WordPress plugin repository. Review the LogHandler changeset for the fix and consult the Wordfence advisory for additional guidance. Upgrade past version 2.10.6 on all affected WordPress installations.

Workarounds

Deactivate the Bit Integrations plugin until the patched version is deployed if an upgrade cannot be performed immediately.
Remove or disable flows that use the WP User Registration "Update User" action with user-controllable password mappings.
Restrict access to the plugin's log screen using role-based access controls or a web application firewall rule.
Truncate existing wp_btcbi_log entries containing untrusted field data to prevent accidental replay.

bash

# Configuration example: list and clear suspect Bit Integrations log rows
wp db query "SELECT id, field_data FROM wp_btcbi_log \
  WHERE field_data LIKE '%user_pass%' OR field_data LIKE '%user_email%';"

# After review, remove suspect rows
wp db query "DELETE FROM wp_btcbi_log \
  WHERE field_data LIKE '%user_pass%';"

# Deactivate the plugin until patched
wp plugin deactivate bit-integrations