CVE-2026-104749

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because IntegrationHandler::executeWithCapture() stores raw, attacker-controlled field values — including user_pass and user_email — verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and LogHandler::reexecute() feeds that stored payload back through Flow::execute() inside the replaying administrator's session without validating the identity that originally produced the data, causing RegistrationController::updateUser() to resolve the target user ID to the administrator and write the attacker-supplied password via wp_update_user(). This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the user_pass parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because IntegrationHandler::executeWithCapture() stores raw, attacker-controlled field values — including user_pass and user_email — verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and LogHandler::reexecute() feeds that stored payload back through Flow::execute() inside the replaying administrator's session without validating the identity that originally produced the data, causing RegistrationController::updateUser() to resolve the target user ID to the administrator and write the attacker-supplied password via wp_update_user(). This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the user_pass parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because IntegrationHandler::executeWithCapture() stores raw, attacker-controlled field values — including user_pass and user_email — verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and LogHandler::reexecute() feeds that stored payload back through Flow::execute() inside the replaying administrator's session without validating the identity that originally produced the data, causing RegistrationController::updateUser() to resolve the target user ID to the administrator and write the attacker-supplied password via wp_update_user(). This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the user_pass parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because IntegrationHandler::executeWithCapture() stores raw, attacker-controlled field values — including user_pass and user_email — verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and LogHandler::reexecute() feeds that stored payload back through Flow::execute() inside the replaying administrator's session without validating the identity that originally produced the data, causing RegistrationController::updateUser() to resolve the target user ID to the administrator and write the attacker-supplied password via wp_update_user(). This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the user_pass parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.