CVE-2026-25019

WordPress Atarim plugin <= 4.3.1 - Broken Access Control vulnerability

Published Feb 3, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.1.

Analysis

Technical impact

This vulnerability is a missing authorization flaw in the Atarim Visual Collaboration plugin for WordPress. It allows an attacker to perform actions that should be restricted to certain users, potentially leading to unauthorized modifications of content, settings, or other resources managed by the plugin. The weakness is classified as CWE‑862 missing authorization.

Affected Systems

The flaw affects the Atarim plugin developed by Vito Peleg, versions 4.3.1 and earlier. Users running WordPress sites with Atarim installed at these versions are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability that this vulnerability will be exploited at the time of this analysis. It is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s web interface or API accessed through a web browser or HTTP client. The description does not specify authentication requirements, so it is unclear whether an unauthenticated user can also exploit the flaw.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Vito Peleg

Atarim

unaffected

Version	Status	Constraints
`0`	affected	≤ 4.3.1

No data.

Vendor	Product	Versions
Vito Peleg	Atarim	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Atarim plugin to a version newer than 4.3.1
If an upgrade is not possible, limit access to the plugin’s administrative features by configuring WordPress role‑based permissions so that only trusted administrators have the required capabilities
Monitor the site for unauthorized changes to content or plugin settings, and implement rate‑limiting or blocking for suspicious requests to the Atarim endpoints to reduce exposure

Generated by OpenCVE AI on April 16, 2026 at 17:28 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.203% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-3-1-broken-access-control-vulnerability?_s_id=cve

History

Feb 4, 2026 12:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Vito Peleg Vito Peleg atarim Wordpress Wordpress wordpress
Vendors & Products		Vito Peleg Vito Peleg atarim Wordpress Wordpress wordpress

Feb 3, 2026 5:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Feb 3, 2026 2:30 PM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.1.
Title		WordPress Atarim plugin <= 4.3.1 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-3-1-broken-access-control-vulnerability?_s_id=cve