The Bit integrations plugin for WordPress, specifically versions up to 2.9.0, contains a directory traversal vulnerability (CWE-22) in the processAttachment function. This flaw allows unauthenticated remote attackers to read arbitrary files on the server by manipulating file path inputs. The vulnerability can lead to disclosure of sensitive information stored on the affected server. The CVSS 3.1 base score is 7.5, reflecting a high impact on confidentiality with no required privileges or user interaction. No vendor advisory or patch has been published yet, and the plugin is not a cloud service, so remediation depends on vendor action or user mitigation.

An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the server hosting the vulnerable WordPress plugin. This can lead to exposure of sensitive information, potentially compromising confidentiality. There is no impact on integrity or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the plugin's functionality, applying web application firewall rules to block suspicious path traversal attempts, or disabling the plugin if possible. Monitor official vendor channels for updates and patches.