PT-2025-35868 · WordPress · Atec Debug

Jonas Benjamin Friedli · Published 2025-09-04 · Updated 2025-09-04 · CVE-2025-9518

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions atec Debug plugin for WordPress versions through 1.2.22

Description The atec Debug plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation on the debug path parameter. This allows authenticated attackers with Administrator-level access or higher to delete arbitrary files on the server, potentially leading to remote code execution if critical files, such as wp-config.php, are deleted.

Recommendations Update the atec Debug plugin to a version beyond 1.2.22.

Fix

Weakness Enumeration

CWE-36

Related Identifiers

CVE-2025-9518

Affected Products

Atec Debug

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-9518 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3355260%40atec-debug%2Ftrunk&old=3342365%40atec-debug%2Ftrunk · Note
• https://twitter.com/CVEnew/status/1963462542115697038 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/170cd2e3-e31b-452e-8c15-d44a8be7757b?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1963602501468311917 · Twitter Post
• https://plugins.trac.wordpress.org/browser/atec-debug/trunk/includes/ATEC/CONFIG.php#L320 · Note