Atec Debug WordPress Plugin Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the Atec Debug plugin for WordPress, affecting all versions through 1.2.22. The issue arises from inadequate sanitization of the 'custom_log' parameter, allowing authenticated attackers with Administrator-level access to execute arbitrary code on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where the affected WordPress site is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user with Administrator privileges can send a request that includes a crafted 'custom_log' parameter. The absence of proper sanitization allows the execution of arbitrary code on the server.

Remediation

Users are advised to update the Atec Debug plugin to version 1.2.23 or later.