Medium severity4.9NVD Advisory· Published Sep 4, 2025· Updated Apr 15, 2026

CVE-2025-9516

Description

The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to view the contents of files outside of the originally intended directory.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Atec Debugllm-fuzzy
Range: <=1.2.22
Package: https://wordpress.org/plugins/atec-debug

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/atec-debug/trunk/includes/ATEC/CONFIG.phpnvd
plugins.trac.wordpress.org/changesetnvd
www.wordfence.com/threat-intel/vulnerabilities/id/4bf43620-34ee-4e4f-b6ee-d24fbdbc894envd

News mentions

No linked articles in our index yet.

cvss	0.319
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000