Bit Integrations CVE-2026-104749

Exploitation requires a non-default configuration: an administrator must have created a flow that maps a user-supplied front-end form field to the user_pass parameter of the WP User Registration 'Update User' action. The attacker-controlled payload (user_pass, user_email) is stored unvalidated via IntegrationHandler::executeWithCapture() on anonymous front-end requests, but the privilege escalation only fires when the administrator subsequently clicks 'Re-execute' on the resulting failure log row from the plugin's log screen, at which point LogHandler::reexecute() replays the payload inside the admin session and RegistrationController::updateUser() resolves the target to the administrator. Key limiting factors: the specific user_pass flow mapping must exist (not default), and mandatory administrator interaction (the Re-execute click) is required - meaning no fully automated, zero-click exploitation is possible.

This is a high-impact (CVSS 7.5, C:H/I:H/A:H full administrator takeover) but condition-heavy flaw whose real-world risk is substantially gated by its own CVSS vector: AV:N and PR:N mean an anonymous remote attacker can plant the payload, but AC:H and UI:R require both a specific non-default flow configuration AND a human administrator to click 'Re-execute' on a failure log row. No EPSS score was provided, no POC is referenced, and the CVE is not listed in CISA KEV - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (the high complexity and required user interaction correctly reflect the two-stage, operator-dependent attack), meaning this is a genuine privilege-escalation risk for environments that happen to use the vulnerable configuration, but it is not a drop-everything mass-exploitation event. Treat it as a targeted, config-dependent risk rather than a wormable internet-wide threat; patch promptly on affected sites but prioritize below unauthenticated zero-click RCEs. Note: EPSS data is missing from the input and cannot be cross-referenced.

An unauthenticated attacker submits a crafted front-end form (e.g., Contact Form 7) on a site where an administrator has mapped a form field to the WP User Registration 'Update User' action's user_pass parameter, embedding an attacker-chosen password and the admin's email. The submission fails and is stored verbatim in wp_btcbi_log; when the administrator later clicks 'Re-execute' on that failure log row, the stored payload runs inside the admin's session and overwrites the administrator's password. No public exploit code is referenced, and exploitation depends on both the specific flow mapping and the admin's re-execution click (CVSS AC:H/UI:R).