The Bit Assist WordPress plugin 'Chat Widget: Floating Customer Support Button for 30+ Channels' (bitpressadmin) contains a CWE-23 relative path traversal vulnerability via the fileID parameter in all versions up to 1.5.2. This flaw allows authenticated users with at least Subscriber privileges to read arbitrary files on the server, which may include sensitive data. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation has been documented in the provided data.

Successful exploitation enables an authenticated attacker with Subscriber-level access or higher to read arbitrary files on the server hosting the vulnerable plugin. This can lead to disclosure of sensitive information stored on the server. There is no indication of impact on integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user privileges where possible and monitor for suspicious activity related to file access. Avoid exposing the vulnerable plugin on publicly accessible environments if feasible.