Description

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpf_delete_file and wpf_delete_file functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files.

Classification

CVE ID: CVE-2024-12104

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.3

Affected Products

Vendor: wpfeedback

Product: Visual Website Collaboration, Feedback & Project Management – Atarim

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.05% (probability of being exploited)

EPSS Percentile: 20.28% (scored less or equal to compared to others)

EPSS Date: 2025-02-19 (when was this score calculated)

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/7d40c658-a156-470e-bf93-a1f2ccec9c61?source=cve
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3225314%40atarim-visual-collaboration&new=3225314%40atarim-visual-collaboration&sfp_email=&sfph_mail=

Timeline