CVE-2025-60188 HIGH

CVE-2025-60188: WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability

Vendor Vito Peleg
Product Atarim
Weakness CWE-201
Published November 6, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.

Explanation of Vulnerability in Simple Terms

02Summary

Atarim versions up to 4.2.1 expose sensitive information to unauthenticated attackers over the network. An attacker can read confidential data without needing valid credentials or user interaction. The vulnerability stems from insufficient access controls on information disclosure. Update to a version newer than 4.2.1 to remediate.

What an attacker can do

03Attacker Capabilities

Read sensitive information from the application without authentication.

Potential impact on your site

04Site Impact

Confidential data may be exposed to anyone on the internet who accesses the vulnerable Atarim instance.

Conditions required to exploit

05Prerequisites

Network access to the Atarim application; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 6, 2025 CVE published
April 28, 2026 Record updated