CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
Bit Assist Chat Widget versions up to 1.5.2 contain a path traversal vulnerability that allows authenticated users to read sensitive files from the server. An attacker with low-level access can bypass directory restrictions and access files outside the intended scope. This exposure could reveal configuration files, credentials, or other confidential data stored on the server.
What an attacker can do
Read arbitrary files on the server outside the intended application directory.
Potential impact on your site
Sensitive server files (configs, credentials, keys) may be exposed to authenticated users with low privileges.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
