Bit integrations <= 2.10.6 - Unauthenticated Privilege Escalation via Identity-Confused Log Re-execution to Account Takeover via Log Re-execution of Anonymous-Captured Field Data

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-104749 · Microsoft / collected KEV context

cve-program · CVE-2026-104749

• https://www.wordfence.com/threat-intel/vulnerabilities/id/24f112eb-4abe-4acf-a769-c93246e30958?source=cve
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Actions/Registration/RegistrationController.php#L309
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Log/LogHandler.php#L290
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Log/LogHandler.php#L553
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Core/Integration/IntegrationHandler.php#L39
• https://plugins.trac.wordpress.org/browser/bit-integrations/tags/2.10.6/backend/Triggers/CF7/CF7Controller.php#L139
• https://plugins.trac.wordpress.org/changeset/3730118/bit-integrations/trunk/backend/Log/LogHandler.php

No related operational record is retained in the current change model.