The plugin contains a flaw that allows an unauthenticated attacker to submit form data that is stored verbatim in a log entry. When an administrator later re‑executes that log entry the system blindly feeds the stored data back into a user registration action, causing the attacker’s supplied password to be used for the administrator account via the WordPress user update function. This results in a full takeover of the site administrator account. The weakness is a credential change exploit that directly increases privileges.

The issue is present in the Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation WordPress plugin for any version 2.10.6 or earlier. WordPress sites using that plugin with a flow that maps the user_pass form field to the Update User action are vulnerable.

The flaw carries a CVSS score of 7.5, indicating high severity, but the EPSS score is below 1 %, and it is not listed in the CISA KEV catalog. Exploitation requires that an unauthenticated attacker be able to submit data to the frontend, that the administrator has configured the flow, and that the administrator subsequently clicks the re‑execute button from the failure log row produced by the plugin's log screen. The likely attack vector is external to the site, inferred from the requirement that an unauthenticated attacker submit form data to the frontend. While the probability of exploitation appears low, once executed it results in a complete privilege escalation.