The atec Debug WordPress plugin allows an authenticated user with Administrator or higher access to specify a custom_log file path via a parameter. The plugin does not sufficiently validate that the requested file resides within the expected directory, enabling reading of any file on the server. This results in disclosure of sensitive data and file contents beyond the intended scope, potentially revealing configuration files, credentials, or other private information. The weakness corresponds to path traversal (CWE‑36).

All WordPress installations using atec Debug versions 1.2.22 or earlier are affected, regardless of how the plugin is configured. The vulnerability is present in every version up to and including the specified release when an Administrator role exists in the site.

The CVSS score of 4.9 indicates a moderate risk level. The EPSS score of less than 1% shows that exploitation is currently unlikely, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have valid Administrator credentials; after authentication, the attacker can craft a request containing the custom_log parameter pointing to an arbitrary file, resulting in the file’s contents being returned to the victim. No additional prerequisites beyond administrator access are needed.