CVE-2026-104749: CWE-269 Improper Privilege Management in bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation WordPress plugin suffers from a privilege escalation vulnerability due to improper privilege management (CWE-269). The function IntegrationHandler::executeWithCapture() stores raw, attacker-controlled field values including sensitive fields like user_pass and user_email into the plugin's log database without capability checks on anonymous front-end requests. Later, LogHandler::reexecute() replays this stored payload inside an administrator's session without validating the original data source identity. This leads to RegistrationController::updateUser() resolving the user ID to the administrator and overwriting the administrator's password via wp_update_user(). Successful exploitation requires an administrator to have configured a flow mapping a user-supplied form field to the user_pass parameter and to click 'Re-execute' on the failure log entry generated by the attacker's anonymous submission.

An unauthenticated attacker can fully compromise the administrator account by overwriting the administrator's password, resulting in complete control over the WordPress site. This impacts confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 7.5 (High), reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid configuring flows that map user-supplied fields to the user_pass parameter and should not use the log re-execution feature on failure logs generated by anonymous submissions. Monitoring plugin updates from the vendor and applying official patches once released is recommended.