Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2025-0822: WordPress Bit Assist plugin can leak sensitive server files
CVE-2025-0822 · published 1 year ago
Summary
Attackers with a WordPress account can access and read sensitive server files, potentially revealing confidential information. This affects all versions of the Bit Assist plugin up to 1.5.2. Update the plugin to a fixed version to prevent unauthorized access.
What to do
- Update bitapps bit_assist to version 1.5.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| bitapps | bit_assist |
< 1.5.3 cpe:2.3:a:bitapps:bit_assist:*:*:*:*:*:wordpress:*:* |
Original advisory text
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscr...
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
References
- https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTT... Product
- https://plugins.trac.wordpress.org/changeset/3239816/#file3 Patch
- https://wordpress.org/plugins/bit-assist/#developers Product Release Notes
- https://www.wordfence.com/threat-intel/vulnerabilities/id/de9b0eba-5d2b-427c-a19... Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-23Relative Path Traversal
CWE-22Path Traversal
Timeline
Published15 Feb 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-0822 · NVD
Track software like this
Free during beta