WordPress atec Debug Plugin Arbitrary File Read Vulnerability

A vulnerability allowing arbitrary file read has been identified in the atec Debug plugin for WordPress, affecting all versions through 1.2.22. This vulnerability arises from the 'custom_log' parameter, enabling authenticated attackers with Administrator-level access to view file contents outside the intended directory.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive file contents on the server.

Reproduction

To reproduce this vulnerability, an authenticated user with Administrator privileges can send a request to the WordPress site with the 'custom_log' parameter. This parameter can be used to specify a file path, allowing the user to read files outside the normal directory restrictions.

Remediation

Users are advised to update the atec Debug plugin to version 1.2.23 or later.