Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-104749 high CVSS 7.5

Privilege Escalation in WordPress (CVE-2026-104749)

Summary

Vulnerability in WordPress (CVE-2026-104749). Successful exploitation can lead to full system takeover. Exploitable via user_pass.

Original description

The description as published by the source.

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execution in all versions up to, and including, 2.10.6 The vulnerability exists because IntegrationHandler::executeWithCapture() stores raw, attacker-controlled field values — including user_pass and user_email — verbatim into wp_btcbi_log.field_data on anonymous front-end requests with no capability check, and LogHandler::reexecute() feeds that stored payload back through Flow::execute() inside the replaying administrator's session without validating the identity that originally produced the data, causing RegistrationController::updateUser() to resolve the target user ID to the administrator and write the attacker-supplied password via wp_update_user(). This makes it possible for unauthenticated attackers to overwrite the administrator's password and fully take over the administrator account. Exploitation requires that an administrator has configured a flow mapping a user-supplied form field to the user_pass parameter of the WP User Registration "Update User" action, and that the administrator subsequently clicks "Re-execute" on the failure log row produced by the anonymous submission from the plugin's log screen.

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-104749 has been found in WordPress.
Attackers can target a specific entry point like user_pass over the network to misuse the product.
Successful exploitation can lead to full system takeover. CVSS score: 7.5/10.
What to do: apply the vendor's official patched release.
If unsure, ask your IT team or search "WordPress CVE-2026-104749" on the vendor's site.

CVE-2026-104749 (WordPress) — CWE-269 / CVSS v3 7.5
Attack vector: remote (network-reachable) / unauthenticated
Attack surface: user_pass / user_email / wp_btcbi_log.field_data
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-269) exists in WordPress. Attackers reach the vulnerable code path via user_pass without authentication.

📍 Affected scope

Check the vendor advisory for the affected versions of WordPress. Attack surface: user_pass / user_email / wp_btcbi_log.field_data.

🔥 Severity

Severity: High (CVSS 7.5/10). Successful exploitation can lead to full system takeover.

🔧 How to fix

Update to the patched release per vendor advisory.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    Audit SBOM/dependencies for affected components.

    資産台帳・SBOM・依存マニフェストで WordPress を使っているサービスとバージョンを洗い出す。

  2. 2
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details