CVE-2025-0822: Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter
First published: Sat Feb 15 2025(Updated: )
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bit Assist | <=1.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/bit-assist/tags/1.5.2/backend/app/HTTP/Controllers/DownloadController.php#L65
- https://plugins.trac.wordpress.org/changeset/3239816/#file3
- https://wordpress.org/plugins/bit-assist/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/de9b0eba-5d2b-427c-a199-88bf96c26f5e?source=cve
Frequently Asked Questions
What is the severity of CVE-2025-0822?
CVE-2025-0822 is classified as a high-severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2025-0822?
To fix CVE-2025-0822, update the Bit Assist plugin to version 1.5.3 or later as it contains the necessary security patches.
Who is affected by CVE-2025-0822?
CVE-2025-0822 affects all users of the Bit Assist plugin for WordPress up to and including version 1.5.2 who have Subscriber-level access or higher.
What type of attack does CVE-2025-0822 allow?
CVE-2025-0822 allows authenticated attackers to exploit path traversal to read arbitrary files on the server.
What are the affected versions of the Bit Assist plugin in CVE-2025-0822?
CVE-2025-0822 affects the Bit Assist plugin for WordPress in all versions up to and including 1.5.2.
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/title
- agent/references
- agent/author
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- vendor/bit assist
- canonical/bit assist