CVE-2025-0822CWE-23

Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter

Medium · published February 15, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00638 · 49.9th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2025-02-15T12:43Z
EPSS history
Timeline
  • 15 FEB 12:43Z
    Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter
    cvelistv5