WordPress Plugin Vulnerabilities

Atarim < 4.2.2 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator.

Affects Plugins

Plugin icon
atarim-visual-collaboration
Fixed in 4.2.2

References

CVE
CVE-2025-60195
URL
https://vdp.patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-2-privilege-escalation-vulnerability

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Denver Jackson
Verified
No
WPVDB ID
c900948b-1c7f-4af7-8bfd-b460c87c5d43

Timeline

Publicly Published
2025-07-27 (about 1 year ago)
Added
2025-12-11 (about 8 months ago)
Last Updated
2025-12-11 (about 8 months ago)

Other

Published
Title
Published
2026-05-04
Title
Mentoring < 1.2.9 - Unauthenticated Privilege Escalation in mentoring_process_registration
Published
2023-11-23
Title
Salon booking system < 8.7 - Authenticated (Editor+) Privilege Escalation
Published
2021-02-24
Title
Woocommerce Customers Manager < 26.5 - Arbitrary Account Creation/Update by Low Privilege Users
Published
2026-07-20
Title
Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation
Published
2025-04-24
Title
Vikinger < 1.9.31 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'