CVE-2026-25019: 
WordPress vulnerability analysis and mitigation

CVE-2026-25019 is a Missing Authorization (Broken Access Control) vulnerability in the Atarim WordPress plugin by Vito Peleg. It affects all versions of the plugin up to and including 4.3.1, and was disclosed on January 30, 2026, with the CVE published on February 3, 2026. The vulnerability allows unauthenticated network-based attackers to exploit incorrectly configured access control security levels. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions lack proper authorization, authentication, or nonce token checks before executing privileged actions. This allows an unauthenticated remote attacker to invoke functionality that should be restricted to higher-privileged users. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit at scale. The vulnerability was discovered by security researcher Nabil Irawan and reported through Patchstack's Active VDP program (Patchstack).

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can perform unauthorized write or modification actions within the plugin's scope. While the individual impact per site is limited, the vulnerability is noted by Patchstack as being the type used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity. No sensitive data exposure or service disruption is expected from exploitation alone (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies it as low priority with low severity impact, though it notes that broken access control vulnerabilities of this type are commonly leveraged in automated mass-exploit campaigns against WordPress sites (Patchstack).

The vendor has released a patched version of the Atarim plugin. Users should update to version 4.3.2 or later immediately to remediate the vulnerability. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).

Wordfence included this vulnerability in their weekly WordPress vulnerability report covering January 26 to February 1, 2026, providing broader community visibility. No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.