A path traversal flaw allows an attacker to craft requests that include patterns such as ".../...//" which the Bit Assist plugin does not properly sanitize. This leads to the ability to read or potentially download arbitrary files located on the underlying file system, compromising the confidentiality of sensitive data and possibly exposing system configuration files. The vulnerability is classified as CWE‑35, indicating unchecked input paths can resolve to unintended files.

WordPress sites that have installed Bit Apps Bit Assist plugin version 1.5.4 or earlier are affected. The flaw exists in all releases from the first public version up until and including 1.5.4, regardless of other plugins or themes present on the site.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% shows a low likelihood of exploitation in the wild according to current data. The vulnerability is not listed in the CISA KEV catalog. Attackers can likely exploit the flaw via a crafted HTTP request to the plugin’s endpoints without authentication, as no authentication requirement is stated in the description. Once exploited, the impact is read or delivery of arbitrary file contents, which could be used to further compromise the system.