CVE-2024-12104
Medium
Description
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files. CVE-2025-22657 may be a duplicate of this issue.
SeverityMedium
CVSS5.3
Exploit probability—
ProductAtarim
PublishedJan 21, 2025
First seenJan 21, 2025
Weakness typeCWE-862Missing authorization
How to fix
Update
- atarim atarim4.1.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| atarim atarim | v < 4.1.0 | 4.1.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.