CVE-2025-0822mediumCWE-23

CVE-2025-0822: medium-severity vulnerability in bitpressadmin Chat Widget: Floating Customer…

Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter

Published · Updated

Follow this CVE+ Monitor Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.6%
Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
bitpressadmin · Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat – Bit Assist
Related CVEs — bitpressadmin Chat Widget: Floating Customer…

In the same product, most dangerous first.

CVE-2024-13791MEDIUMBit Assist <= 1.5.2 - Path Traversal to Authenticated (Administrator+) Arbitrary File Read via downloadResponseFile FunctionEPSS 0.7%CVE-2025-0821MEDIUMBit Assist <= 1.5.2 - Authenticated (Subscriber+) SQL Injection via id ParameterEPSS 0.6%