Arbitrary File Read Vulnerability in Atec Debug Plugin for WordPress

CVE-2025-9516

What is CVE-2025-9516?

The Atec Debug plugin for WordPress is susceptible to an arbitrary file read vulnerability that affects all versions up to and including 1.2.22. This vulnerability is triggered via the 'custom_log' parameter, enabling authenticated attackers with Administrator-level access or higher to access file contents situated outside of the designated directory. Such exposure can lead to potential data breaches and unauthorized disclosure of sensitive information. It is critical for users of this plugin to ensure that they are on the latest version to mitigate risks associated with this flaw.

References