Atarim CVE-2025-60188
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.
AnalysisAI
Sensitive data exposure in Atarim WordPress plugin versions ≤4.2 allows remote unauthenticated attackers to retrieve embedded confidential information through network requests. Publicly available exploit code exists. EPSS score of 5.50% (90th percentile) indicates elevated real-world exploitation likelihood compared to most vulnerabilities, though CISA KEV does not yet list active exploitation. The CVSS vector shows network-accessible information disclosure requiring no authentication or user interaction, making this a high-priority remediation target for sites running affected versions.
Technical ContextAI
Atarim is a WordPress visual collaboration and client feedback plugin that enables website stakeholders to communicate and track changes. This vulnerability stems from CWE-201 (Insertion of Sensitive Information Into Sent Data), where the application inadvertently includes confidential data in responses or transmissions that should not contain it. The plugin's architecture appears to expose sensitive embedded data through network-accessible endpoints without proper access controls or data sanitization. The complete lack of authentication requirements (PR:N) and low attack complexity (AC:L) indicate the vulnerable endpoint is directly accessible over HTTP/HTTPS without security barriers, likely through REST API routes or AJAX handlers common in WordPress plugins.
Affected ProductsAI
The vulnerability affects the Atarim (formerly known as zippy or WP Feedback) WordPress plugin in all versions up to and including version 4.2. The plugin is developed by Vito Peleg and distributed through the official WordPress.org plugin repository. Organizations should verify their installed version through the WordPress admin dashboard under Plugins. Detailed vulnerability information is available in the Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-2-sensitive-data-exposure-vulnerability-2?_s_id=cve.
RemediationAI
Immediately upgrade Atarim plugin to version 4.3 or later, which contains the security fix for this data exposure vulnerability. Access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate Atarim, and click Update Now. Verify the update completed successfully by confirming version 4.3+ in the plugin details. If immediate patching is not feasible, implement compensating controls: disable the Atarim plugin entirely until patching is complete, restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules, and audit server logs for suspicious requests to wp-admin/admin-ajax.php or REST API endpoints associated with Atarim (pattern: /wp-json/atarim/*). Note that deactivating the plugin will disrupt active collaboration workflows and client feedback functionality. Review WordPress access logs from the past 30 days for unauthorized data retrieval attempts targeting the plugin's endpoints. Consult the Patchstack advisory and GitHub POC repository (https://github.com/m4sh-wacker/CVE-2025-60188-Atarim-Plugin-Exploit) to understand specific data exposure patterns for forensic investigation.
Share
External POC / Exploit Code
Leaving vuln.today