Privilege Escalation Vulnerability in Bit Integrations Plugin for WordPress

CVE-2026-104749

What is CVE-2026-104749?

The Bit Integrations plugin for WordPress is susceptible to a privilege escalation vulnerability that allows unauthenticated attackers to overwrite an administrator's password. This flaw emerges from the executeWithCapture() function, which improperly handles and stores raw field values like user_pass and user_email during anonymous front-end requests without appropriate access checks. When an administrator triggers the re-execution of logs shown on the plugin's log screen, the attacker-controlled payload can be relayed back through the administrator's session. Consequently, if the administrator has linked a user-supplied form field to the user_pass parameter of the WP User Registration 'Update User' action, an attacker can exploit this vulnerability to assume full control of the administrator account.

References