CVE-2025-0822: Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0822?
CVE-2025-0822 is classified as a high-severity vulnerability due to its potential for unauthorized file access.
How do I fix CVE-2025-0822?
To fix CVE-2025-0822, update the Bit Assist plugin to version 1.5.3 or later as it contains the necessary security patches.
Who is affected by CVE-2025-0822?
CVE-2025-0822 affects all users of the Bit Assist plugin for WordPress up to and including version 1.5.2 who have Subscriber-level access or higher.
What type of attack does CVE-2025-0822 allow?
CVE-2025-0822 allows authenticated attackers to exploit path traversal to read arbitrary files on the server.
What are the affected versions of the Bit Assist plugin in CVE-2025-0822?
CVE-2025-0822 affects the Bit Assist plugin for WordPress in all versions up to and including 1.5.2.