GCVE - cpe:2.3:a:docjojo:atec_debug:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:docjojo:atec_debug:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Docjojo (`db637476-b0e1-5ad7-93a7-f2c1854ae8cb`)
Product	Atec Debug (`2139bc55-6544-5776-a5e5-d4fb4f9b7110`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-9518`	vulnerable	2026-06-08 07:45:22.601372	atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Deletion HIGH (7.2) The atec Debug plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation on the 'debug_path' parameter in all versions up to, and including, 1.2.22. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Published: 2025-09-04T04:23:47.557Z Updated: 2026-04-08T16:37:17.206Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/170cd2e3-e31b-452e-8c15-d44a8be7757b?source=cve https://plugins.trac.wordpress.org/browser/atec-debug/trunk/includes/ATEC/CONFIG.php#L320 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3355260%40atec-debug%2Ftrunk&old=3342365%40atec-debug%2Ftrunk	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9517`	vulnerable	2026-06-08 07:45:22.601014	atec Debug <= 1.2.22 - Authenticated (Administrator+) Remote Code Execution HIGH (7.2) The atec Debug plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This is due to insufficient sanitization when saving the custom log path. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server. Published: 2025-09-04T04:23:48.559Z Updated: 2026-04-08T17:10:59.857Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/99fc02ea-5399-4ff2-a5f9-27878cadf40d?source=cve https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3355260%40atec-debug%2Ftrunk&old=3342365%40atec-debug%2Ftrunk	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-9516`	vulnerable	2026-06-08 07:45:22.600739	atec Debug <= 1.2.22 - Authenticated (Administrator+) Arbitrary File Read MEDIUM (4.9) The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to view the contents of files outside of the originally intended directory. Published: 2025-09-04T04:23:48.169Z Updated: 2026-04-08T16:51:07.738Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/4bf43620-34ee-4e4f-b6ee-d24fbdbc894e?source=cve https://plugins.trac.wordpress.org/browser/atec-debug/trunk/includes/ATEC/CONFIG.php#L327 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3355260%40atec-debug%2Ftrunk&old=3342365%40atec-debug%2Ftrunk	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.