The Atarim Visual Collaboration plugin for WordPress contains a missing authorization flaw (CWE‑862). This defect permits users who are not administrators to invoke plugin functions that should be restricted, potentially enabling unauthorized modification or deletion of content managed by the plugin. The loss of proper access control can lead to compromise of data integrity and, in some cases, unauthorized data disclosure.

All WordPress sites that have the Atarim Visual Collaboration plugin installed at version 4.2.1 or earlier are affected. The vulnerability applies to every instance of the plugin from its initial release forward up to 4.2.1, regardless of the underlying WordPress core version.

The CVSS score of 6.5 places this issue in the moderate severity range. The EPSS score of less than 1 percent indicates a low likelihood of exploitation as of the last assessment, and it is not listed in the CISA KEV catalog. It is inferred that attackers would attempt to exploit the flaw remotely, using crafted HTTP requests directed at the plugin’s endpoints, because the plugin operates through the WordPress web interface and no special network or authentication prerequisites beyond legitimate access are described.