atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion
high
The atec Debug plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation on the 'debug_path' parameter in all versions up to, and including, 1.2.22. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on th...
- CVSS:
- 7.2
- Affected:
- up to 1.2.22
- Fixed in:
- 1.2.23
- Disclosed:
- Sep 3, 2025
CVE-2025-9518 on NVD →
atec Debug <= 1.2.22 - Authenticated (Administrator+) Remote Code Execution
high
The atec Debug plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This is due to insufficient sanitization when saving the custom log path. This makes it possible for authenticated attackers, with Administrator-level access and above,...
- CVSS:
- 7.2
- Affected:
- up to 1.2.22
- Fixed in:
- 1.2.23
- Disclosed:
- Sep 3, 2025
CVE-2025-9517 on NVD →
atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Read
medium
The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to view the contents of files outside of the originally intended directory.
- CVSS:
- 4.9
- Affected:
- up to 1.2.22
- Fixed in:
- 1.2.23
- Disclosed:
- Sep 3, 2025
CVE-2025-9516 on NVD →
atec Debug [atec-debug] < 1.2.23
unknown
- Affected:
- up to 1.2.23
- Fixed in:
- 1.2.23
CVE-2025-9518 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database