6.5Medium

CVE-2025-0822Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter

bitpressadmin Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist Published: 2025-02-15 15:43 (1 year ago)

Description

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Weakness (CWE): CWE-23 CWE-22

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
bitapps	bit assist	< 1.5.3
bitpressadmin	Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist	≤ 1.5.2

References and patches

https://www.wordfence.com/threat-intel/vulnerabilities/id/de9b0eba-5d2b-427c-a199-88bf96c26f5e?source=cve Third Party Advisory
https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/DownloadControl… Product
https://wordpress.org/plugins/bit-assist/#developers ProductRelease Notes
https://plugins.trac.wordpress.org/changeset/3239816/#file3 Patch

CPE matches (NVD) (1)

cpe:2.3:a:bitapps:bit_assist:*:*:*:*:*:wordpress:*:* < 1.5.3

CVSS score

6.5Medium

Source: Wordfence · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

All scores (2)

cna	CVSS 3.1	6.5Medium
security@wordfence.com	CVSS 3.1	6.5Medium

EPSS (chance of exploitation in 30 days)

0.64%

higher than 51% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2025-01-29
Published2025-02-15 15:43
Reached IP-DB2026-10-25 00:01
Last updated2026-06-17 11:27

Assigned by (CNA): Wordfence
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

6.5Medium

CVE-2026-125796 3 hours ago

WordPress JS Help Desk plugin <= 5.0.5 - Broken Access Control vulnerability

Ahmad JS Help Desk

Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.5.

7.1High

CVE-2026-125830 3 hours ago

WordPress belingoGeo plugin <= 1.13.3 - Cross Site Scripting (XSS) vulnerability

Belingo belingoGeo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Belingo belingoGeo belingogeo allows Reflected XSS.This issue affects belingoGeo: from n/a through 1.13.3.

5.0Medium

CVE-2026-125826 3 hours ago

WordPress PowerPress Podcasting plugin <= 11.18.3 - Arbitrary File Deletion vulnerability

Blubrry Podcasting PowerPress Podcasting

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Path Traversal.This issue affects PowerPress Podcasting: from n/a through 11.18.3.

7.5High

CVE-2026-125823 3 hours ago

WordPress Gutenverse plugin <= 4.2.2 - Denial of Service Attack vulnerability

Jegstudio Gutenverse

Allocation of Resources Without Limits or Throttling vulnerability in Jegstudio Gutenverse gutenverse allows HTTP DoS.This issue affects Gutenverse: from n/a through 4.2.2.

7.1High

CVE-2026-125818 3 hours ago

WordPress wpDiscuz plugin <= 7.6.75 - Cross Site Scripting (XSS) vulnerability

AdvancedCoding wpDiscuz

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.75.

7.1High

CVE-2026-125804 3 hours ago

WordPress AI Engine plugin <= 3.9.3 - Cross Site Scripting (XSS) vulnerability

Meow Apps AI Engine

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI Engine ai-engine allows Stored XSS.This issue affects AI Engine: from n/a through 3.9.3.