Atarim CVE-2025-60188

Remote unauthenticated exploitation against default configurations of Atarim WordPress plugin versions ≤4.2. The vulnerability requires only that the Atarim plugin is installed and active on a WordPress site with network-accessible endpoints (standard for all WordPress installations). No special features, non-default settings, or specific deployment modes are required. The CVSS vector PR:N confirms zero authentication requirements, and AC:L indicates no timing windows, race conditions, or complex preparation steps. Limiting factors: exploitation requires the target site to have Atarim plugin version 4.2 or earlier installed and activated, and the vulnerable endpoint must be network-accessible (blocked by IP whitelisting or Web Application Firewall rules would prevent exploitation).

This represents a genuine high-priority risk despite the absence of confirmed active exploitation. The CVSS 7.5 score accurately reflects the threat: network-accessible (AV:N), trivial to exploit (AC:L), requiring no privileges (PR:N) or user interaction (UI:N), with high confidentiality impact (C:H). The EPSS 90th percentile placement signals that security researchers and attackers consider this vulnerability significantly more exploitable than average CVEs. Public POC availability on GitHub drastically lowers the technical barrier for opportunistic scanning and exploitation. The CVSS vector indicates this is automatable, making it suitable for mass exploitation campaigns. However, the lack of CISA KEV listing suggests exploitation remains opportunistic rather than part of active targeted campaigns. WordPress plugin vulnerabilities with public exploits historically see rapid scanning activity once published. Organizations running Atarim must treat this as urgent due to the combination of zero authentication requirements, public exploit code, and the sensitive nature of data potentially exposed through collaboration workflows.

An unauthenticated remote attacker identifies a WordPress site running Atarim plugin version 4.2 through automated scanning or manual reconnaissance. Using the publicly available GitHub POC exploit, the attacker sends crafted HTTP requests to the plugin's vulnerable endpoint, likely an AJAX handler or REST API route that fails to validate authentication. The application responds with sensitive embedded data such as internal comments, client feedback, project communications, authentication tokens, or configuration details that were intended to remain confidential within the collaboration workflow. The attacker harvests this information without triggering authentication challenges or generating suspicious user-facing errors.