{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-104749 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-104749 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-104749 is a high-severity vulnerability in bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-104749 and fix it if it is affected.\n\nWhat it is: CVE-2026-104749 is a high-severity vulnerability in bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-104749 in the wild and no public exploit code.\n\nAffected product: bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-104749/ (Markdown: https://insights.sbomify.com/CVE-2026-104749/index.md)","id":"CVE-2026-104749","markdown":"https://insights.sbomify.com/CVE-2026-104749/index.md","name":"CVE-2026-104749","record":{"aliases":["GHSA-8mmw-9hhm-8rr4"],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["account_takeover","privilege_escalation"],"network_reachable":"yes","non_default_config":true,"product_category":"WordPress plugin","requires_auth":"none","summary":"Unauthenticated attackers can take over administrator accounts by exploiting log re-execution flaws in the Bit integrations WordPress plugin.","user_interaction":"required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Wordfence","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"description":"The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because `IntegrationHandler::executeWithCapture()` stores raw, attacker-controlled field values — including `user_pass` and `user_email` — verbatim into `wp_btcbi_log.field_data` on anonymous front-end requests with no capability check, and `LogHandler::reexecute()` feeds that stored payload back through `Flow::execute()` inside the replaying administrator's session without validating the identity that originally produced the data, causing `RegistrationController::updateUser()` to resolve the target user ID to the administrator and write the attacker-supplied password via `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the `user_pass` parameter of the WP User Registration \"Update User\" action, and that the administrator subsequently clicks \"Re-execute\" on the failure log row produced by the anonymous submission from the plugin's log screen.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Privilege escalation in Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation","id":"CVE-2026-104749","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"privilege_escalation","year":"2026"},"n_packages":0,"n_references":7,"next":{"headline":"Rank Math SEO \u003c 1.0.280 - Unauthenticated SEO Analyzer Results Deletion","id":"CVE-2026-104751"},"packages":[],"prev":{"headline":"Privilege escalation in SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications","id":"CVE-2026-104748"},"products":["Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS \u0026 Email Automation"],"published":"2026-10-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-14","vendors":["bitpressadmin"]},"summary":"Unauthenticated attackers can take over administrator accounts by exploiting log re-execution flaws in the Bit integrations WordPress plugin.","url":"https://insights.sbomify.com/CVE-2026-104749/"}