Bit Assist WordPress Plugin Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in the Bit Assist plugin for WordPress, affecting all versions through 1.5.2. The issue arises in the downloadResponseFile() function, where authenticated attackers with Administrator-level access can exploit the vulnerability to read arbitrary files on the server, potentially accessing sensitive information.

Impact

Exploitation of this vulnerability allows for arbitrary file read on the server, which could lead to exposure of sensitive information.

Reproduction

To reproduce this vulnerability, an authenticated user with Administrator-level access can send a request to the downloadResponseFile() function. The request must include the 'widgetChannelID', 'fileID', and 'fileName' parameters. The 'fileID' parameter can be manipulated to traverse directories and access arbitrary files on the server.

Remediation

Users are advised to update the Bit Assist WordPress plugin to version 1.5.3 or later.