Atec Debug WordPress Plugin Arbitrary File Deletion Vulnerability

A vulnerability allowing arbitrary file deletion has been identified in the Atec Debug plugin for WordPress, affecting all versions through 1.2.22. This issue arises from inadequate validation of file paths in the 'debug_path' parameter, enabling authenticated attackers with Administrator-level access to delete arbitrary files on the server. Exploitation of this vulnerability could lead to remote code execution, particularly if critical files like wp-config.php are removed.

Impact

Successful exploitation allows authenticated users with Administrator privileges to delete arbitrary files on the server, potentially leading to remote code execution.

Reproduction

To reproduce this vulnerability, an authenticated user with Administrator access can send a request to the WordPress site with the 'debug_path' parameter set to a file path of an arbitrary file on the server. The insufficient validation in the plugin will allow the file to be deleted. After the file is deleted, if a sensitive file such as 'wp-config.php' is removed, it could lead to remote code execution.

Remediation

Users are advised to update the Atec Debug plugin to version 1.2.23 or later.