Arbitrary File Deletion in Atec Debug Plugin for WordPress

CVE-2025-9518

What is CVE-2025-9518?

The Atec Debug plugin for WordPress suffers from a vulnerability that permits authenticated users with Administrator-level access to delete arbitrary files on the server. This issue arises from insufficient validation of the 'debug_path' parameter. If exploited, it can lead to significant security breaches, including the potential for remote code execution by targeting sensitive files like wp-config.php.

References