Bit Assist WordPress Plugin Path Traversal Vulnerability Allowing Arbitrary File Read

A path traversal vulnerability has been identified in the Bit Assist plugin for WordPress, affecting all versions through 1.5.2. The vulnerability arises in the DownloadController.php file, where the 'fileID' parameter can be manipulated by authenticated users with Subscriber-level access or higher. This exploitation allows for reading arbitrary files on the server, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the 'downloadResponseFile' method in the DownloadController. The 'fileID' parameter can be manipulated to traverse the file system and access arbitrary files.

Remediation

Users are advised to update the Bit Assist WordPress plugin to version 1.5.3 or later, where this vulnerability has been patched.