The Bit Assist WordPress plugin contains a relative path traversal vulnerability (CWE-23) in the downloadResponseFile() function, present in all versions up to and including 1.5.2. This flaw allows authenticated attackers with Administrator-level access to read arbitrary files on the server by manipulating file path inputs. The vulnerability has a CVSS 3.1 base score of 4.9, indicating medium severity, with a network attack vector, low attack complexity, and no user interaction required. The impact is limited to confidentiality as it allows reading sensitive files but does not affect integrity or availability.

Successful exploitation enables an attacker with administrator privileges to read arbitrary files on the server, potentially exposing sensitive data. The vulnerability does not allow code execution or denial of service. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing sensitive files on the server and consider disabling or removing the vulnerable plugin if possible.