CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The atec Debug plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation on the 'debug_path' parameter in all versions up to, and including, 1.2.22. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Explanation of Vulnerability in Simple Terms
atec Debug versions up to 1.2.22 contain a path traversal vulnerability that allows authenticated administrators to read, write, or delete arbitrary files on the server. The vulnerability requires high-level privileges and network access but does not require user interaction. An attacker with admin credentials can exploit this to compromise the entire server.
What an attacker can do
Read, write, or delete arbitrary files on the server with admin privileges.
Potential impact on your site
An admin account compromise could lead to full server takeover, data theft, or site destruction.
Conditions required to exploit
Attacker must have administrator-level access to the application.
Key dates
External resources
Related vulnerabilities
