CVEvulnerability

CVE-2025-0822

6.5 MEDIUM Published 2025-02-15 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2025-02-15
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-22, CWE-23

Description

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

Affected configurations

• bitapps bit assist (< 1.5.3)

Weakness · CWE (2)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
CWE-23 Relative Path Traversal weakness

References

https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/DownloadController.php#L65 Product
https://plugins.trac.wordpress.org/changeset/3239816/#file3 Patch
https://wordpress.org/plugins/bit-assist/#developers Product, Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/de9b0eba-5d2b-427c-a199-88bf96c26f5e?source=cve Third Party Advisory

CVE-2025-0822

Description

Affected configurations

Related

Weakness · CWE (2)

References