The atec Debug WordPress plugin contains a remote code execution flaw triggered by the custom_log parameter. When an attacker with Administrator or higher privileges supplies a malicious value for this parameter, the plugin's inadequate sanitization allows the data to be executed on the server. This flaw gives the attacker full control over the host, potentially leading to data theft, defacement, or further compromise of connected systems.

The vulnerability applies to the atec Debug plugin for WordPress, version 1.2.22 and all earlier releases. The affected product is maintained by the vendor docjojo and is designed to assist developers with debugging WordPress sites.

The CVSS score of 7.2 indicates moderate to high severity, while the EPSS score of less than 1% suggests a very low probability of exploitation at this time. The exploit requires authenticated access with Administrator rights, and because the flaw is within a plugin the vulnerability is confined to sites that have the atec Debug plugin installed and are running an unpatched version. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation yet.