What is the CVSS score of CVE-2025-62895?

CVE-2025-62895 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Plugin are affected by CVE-2025-62895?

CVE-2025-62895 exposes sensitive data through the Atarim Visual Collaboration WordPress plugin (versions ≤4.2.1), allowing unauthenticated attackers to extract confidential information via…

How to fix or mitigate CVE-2025-62895?

Within 24 hours: Identify all WordPress installations running Atarim plugin versions 4.2.1 or earlier and disable the plugin pending remediation. Within 7 days: Contact Atarim for patch timeline; if available, apply immediately upon release to all affected instances. Within 30 days: Conduct data exposure assessment to determine what sensitive information may have been accessed, implement access logging on remaining plugin endpoints, and establish vendor patch monitoring for this plugin.

Wordpress Plugin CVE-2025-62895

MEDIUM

Insertion of Sensitive Information Into Sent Data (CWE-201)

2025-10-27 audit@patchstack.com

WordPress Information Disclosure Wordpress Plugin

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:42 NVD

HIGH MEDIUM

CVSS changed

Apr 23, 2026 - 15:42 NVD

7.5 (HIGH) 5.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 27, 2025 - 02:15 nvd

HIGH 7.5

DescriptionCVE.org

Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.

AnalysisAI

Sensitive data exposure in Atarim Visual Collaboration WordPress plugin (versions through 4.2.1) allows unauthenticated remote attackers to retrieve embedded confidential information via network-accessible endpoints. The vulnerability enables direct extraction of sensitive data with no authentication required and low attack complexity. EPSS score of 0.03% (10th percentile) indicates minimal current exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.

Technical ContextAI

This vulnerability manifests as CWE-201 (Insertion of Sensitive Information Into Sent Data), where the Atarim Visual Collaboration WordPress plugin inadvertently embeds or transmits sensitive data through its communication channels without proper sanitization or access controls. The plugin facilitates collaboration and feedback workflows on WordPress sites, typically handling project data, user communications, and potentially authentication tokens or configuration details. The flaw likely stems from insufficient output filtering or API response sanitization, allowing sensitive fields to be included in responses to unauthenticated requests. Given the plugin's collaborative nature, exposed data could include internal project details, user information, API keys, or system configuration metadata that should remain restricted to authenticated administrators or authorized team members.

Affected ProductsAI

The vulnerability affects the Atarim Visual Collaboration WordPress plugin developed by Vito Peleg, specifically all versions from initial release through version 4.2.1 inclusive. This is a WordPress ecosystem plugin used for visual feedback and collaboration workflows on WordPress websites. The vendor-neutral description indicates the vulnerability exists across the entire version history up to and including 4.2.1, meaning all installations running any release at or below this version are susceptible to sensitive data exposure. The Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-2-sensitive-data-exposure-vulnerability?_s_id=cve serves as the primary reference for affected version confirmation and vendor notification details.

RemediationAI

Organizations should upgrade the Atarim Visual Collaboration plugin to version 4.2.2 or later if available, as versions through 4.2.1 are confirmed vulnerable. Consult the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-2-sensitive-data-exposure-vulnerability?_s_id=cve for specific patch availability and vendor advisory details. As an immediate risk mitigation measure prior to patching, administrators can temporarily disable the Atarim plugin if visual collaboration features are not business-critical, or implement web application firewall rules to restrict access to plugin endpoints to authenticated administrative users only. Review WordPress access logs for suspicious access patterns to Atarim-related URLs from unauthenticated sources, and audit any potentially exposed sensitive data to determine if credential rotation or additional security measures are warranted. After applying updates, verify that sensitive information is no longer accessible through unauthenticated API calls or plugin endpoints.