CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Bit Assist Chat Widget versions up to 1.5.2 contain a path traversal vulnerability that allows high-privilege users to read sensitive files from the server. An attacker with admin or elevated access can bypass directory restrictions and access files outside the intended application directory. This exposure is limited to confidentiality; the vulnerability does not allow file modification or system disruption.
What an attacker can do
Read arbitrary files on the server outside the application directory.
Potential impact on your site
Sensitive configuration files, database credentials, or other private data stored on the server could be exposed to privileged users.
Conditions required to exploit
Attacker must have high-level admin or privileged account access to the site.
Key dates
External resources
Related vulnerabilities
