The Atarim plugin for WordPress, a popular tool for visual website collaboration and project management, has a notable security vulnerability. This flaw, identified as CVE-2024-12104, could allow malicious actors to delete important project pages and files without needing any authentication.<\/p>\n
Essentially, the plugin was missing a crucial security check when handling certain functions, specifically The vulnerability impacts all versions of the Atarim plugin for WordPress up to, and including, version 4.0.9.<\/p>\n The vulnerability has been thoroughly analyzed, and details have been publicly disclosed to ensure users are aware of the risks. Developers have addressed the issue with a security patch.<\/p>\n This vulnerability is rated as Medium severity, with a CVSS score of 5.3. While it doesn’t involve remote code execution or direct system compromise, the potential for unauthorized data deletion could significantly impact website owners and project managers. Losing project pages and files can lead to operational disruptions and potential data recovery costs.<\/p>\n The good news is that a fix is available! To protect your WordPress site and project data, it is crucial to update your Atarim plugin immediately.<\/p>\n We strongly recommend all users of the Atarim plugin update to version 4.1.0 or newer as soon as possible to mitigate this risk.<\/p>\n https:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=&sfph_mail=&reponame=&old=3225314%40atarim-visual-collaboration&new=3225314%40atarim-visual-collaboration&sfp_email=&sfph_mail=<\/p>\n https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/7d40c658-a156-470e-bf93-a1f2ccec9c61?source=cve<\/p>\n","protected":false},"excerpt":{"rendered":" The Atarim plugin for WordPress, a popular tool for visual website collaboration and project management, has a notable security vulnerability. This flaw, identified as CVE-2024-12104, could allow malicious actors to delete important project pages and files without needing any authentication. Essentially, the plugin was missing a crucial security check when handling certain functions, specifically wpf_delete_file. […]<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1017,874,755,695,726],"class_list":["post-3356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-atarim","tag-data-loss","tag-plugin-security","tag-web-security","tag-wordpress"],"blocksy_meta":[],"yoast_head":"\nwpf_delete_file<\/code>. This oversight meant that unauthorized individuals could trigger these functions and cause an unintended loss of your valuable data.<\/p>\nCVE Details<\/h2>\n
\n
Affected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n