The vulnerability is a time‑based SQL injection that is triggered through the ‘id’ parameter used by the Bit Assist plugin. The attacker must be authenticated with at least subscriber‑level privileges. The flaw arises from insufficient escaping of user input and from building a SQL statement without proper parameterization. Exploitation allows the attacker to inject additional SQL clauses, enabling extraction of arbitrary data from the WordPress database such as user accounts, email addresses, or any other storeable data. The impact is a breach of confidentiality and potential compromise of sensitive information, but no direct code execution or privilege escalation is implied by the flaw alone.

WordPress sites that have installed the Bit Assist chat‑widget plugin version 1.5.2 or earlier. The plugin, developed by Bit Assist, is available for WordPress through the plugin repository and exposes the vulnerable endpoint via its backend controller. Users on all WordPress installations that enable the plugin are affected unless they have upgraded past the vulnerable version.

The CVSS score of 6.5 rates the flaw as moderate, reflecting the requirement of authenticated access and the potential for data exposure. The EPSS score of less than 1% indicates a low probability of exploitation at present, and the issue is not listed in CISA’s KEV catalog, so it is not known to be actively exploited. The attack vector is likely a web‑based POST or GET request directed at the administrative interface of the plugin, only reachable by users who can log in with subscriber or higher roles. Once authenticated, an attacker can inject malicious SQL fragments through the id parameter to pull data from the database. No additional privileges are necessary beyond those normally granted to a subscriber account, making the vulnerability significant for sites that grant such access to regular users.