CVE-2024-12104: Visual Website Collaboration, Feedback & Project Management – Atarim <= 4.0.9 - Missing Authorization to Authenticated (Subscriber+) Project Page/File Deletion
The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfdeletefile and wpfdeletefile functions in all versions up to, and including, 4.0.9. This makes it possible for unauthenticated attackers to delete project pages and files. CVE-2025-22657 may be a duplicate of this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12104?
CVE-2024-12104 has a medium severity rating due to the potential for unauthorized data loss.
How do I fix CVE-2024-12104?
To fix CVE-2024-12104, update the Atarim plugin for WordPress to version 4.1.0 or later.
What versions are affected by CVE-2024-12104?
All versions of the Atarim plugin for WordPress up to and including 4.0.9 are affected by CVE-2024-12104.
What functions are vulnerable in CVE-2024-12104?
The vulnerable functions in CVE-2024-12104 are wpf_delete_file and wpf_delete_file, which lack proper capability checks.
Can CVE-2024-12104 lead to data loss?
Yes, CVE-2024-12104 can lead to unauthorized loss of data if exploited due to the missing capability checks.