CVE-2026-104749 bitpressadmin CVE debrief

Who should care

WordPress administrators and users of the Bit integrations plugin should assess their exposure and prioritize updating to a secure version of the plugin. This vulnerability is particularly concerning for sites with multiple administrators or those that use the plugin for sensitive operations.

Why it matters

CVE-2026-104749 is a high-severity vulnerability in the Bit integrations plugin for WordPress, allowing unauthenticated attackers to escalate privileges and potentially take over administrator accounts. Immediate attention is required to assess exposure and update to a secure version.

• Unauthenticated attackers can escalate privileges to administrator level.
• Attackers can take over administrator accounts by supplying malicious user data.
• Successful exploitation requires an administrator to have configured a specific flow mapping a user-supplied form field to the 'user_pass' parameter.
• Verification of affected versions, exploitation, and remediation details is necessary.

Technical summary

The Bit integrations plugin for WordPress stores raw, attacker-controlled field values verbatim into logs on anonymous front-end requests without capability checks. When these logs are re-executed, an attacker can supply malicious data, including user passwords, to escalate privileges and potentially take over administrator accounts. The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator

Defensive priority

High

Recommended defensive actions

• Immediately update the Bit integrations plugin to a version beyond 2.10.6.
• Review and restrict administrator access to sensitive areas of the WordPress site.
• Monitor logs for suspicious activity related to the Bit integrations plugin.
• Consider implementing additional security measures such as two-factor authentication for administrator accounts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in versions up to 2.10.6 of the Bit integrations plugin and the insecure log handling practices that enable the privilege escalation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.