Description
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.1.
Published: 2026-02-03
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Broken Access Control
Action: Upgrade
AI Analysis

Impact

This vulnerability is a missing authorization flaw in the Atarim Visual Collaboration plugin for WordPress. It allows an attacker to perform actions that should be restricted to certain users, potentially leading to unauthorized modifications of content, settings, or other resources managed by the plugin. The weakness is classified as CWE‑862 missing authorization.

Affected Systems

The flaw affects the Atarim plugin developed by Vito Peleg, versions 4.3.1 and earlier. Users running WordPress sites with Atarim installed at these versions are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability that this vulnerability will be exploited at the time of this analysis. It is not listed in the CISA KEV catalog. The likely attack vector is via the plugin’s web interface or API accessed through a web browser or HTTP client. The description does not specify authentication requirements, so it is unclear whether an unauthenticated user can also exploit the flaw.

Generated by OpenCVE AI on April 16, 2026 at 17:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Atarim plugin to a version newer than 4.3.1
  • If an upgrade is not possible, limit access to the plugin’s administrative features by configuring WordPress role‑based permissions so that only trusted administrators have the required capabilities
  • Monitor the site for unauthorized changes to content or plugin settings, and implement rate‑limiting or blocking for suspicious requests to the Atarim endpoints to reduce exposure

Generated by OpenCVE AI on April 16, 2026 at 17:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 04 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Vito Peleg
Vito Peleg atarim
Wordpress
Wordpress wordpress
Vendors & Products Vito Peleg
Vito Peleg atarim
Wordpress
Wordpress wordpress

Tue, 03 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Feb 2026 14:30:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.3.1.
Title WordPress Atarim plugin <= 4.3.1 - Broken Access Control vulnerability
Weaknesses CWE-862
References

Subscriptions

Vito Peleg Atarim
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-01T14:14:41.979Z

Reserved: 2026-01-28T09:51:55.183Z

Link: CVE-2026-25019

cve-icon Vulnrichment

Updated: 2026-02-03T16:13:58.322Z

cve-icon NVD

Status : Deferred

Published: 2026-02-03T15:16:20.063

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-25019

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-16T17:30:26Z

Weaknesses