CVE-2024-13791mediumCWE-23

CVE-2024-13791: medium-severity vulnerability in bitpressadmin Chat Widget: Floating Customer…

Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile Function

Published · Updated

Follow this CVE+ Monitor Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.9epss 0.7%
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the downloadResponseFile() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
bitpressadmin · Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist
Related CVEs — bitpressadmin Chat Widget: Floating Customer…

In the same product, most dangerous first.

CVE-2025-0822MEDIUMBit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID ParameterEPSS 0.6%CVE-2025-0821MEDIUMBit Assist <= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id ParameterEPSS 0.6%