CVE-2025-60195CWE-266

CVE-2025-60195

Critical · published November 6, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
35.4
In the wild
Unconfirmed
What it is

🚨 A misconfigured privilege assignment in Atarim could let any user become an admin! 🔥 Think of it like a restaurant where anyone can just walk in and start serving food, regardless of their training or authority. That's how this vulnerability operates—a door that should be locked is wide open! An attacker could gain full control over the Atarim platform, allowing them to access sensitive data, change settings, and wreak havoc across your collaboration tools. This level of privilege escalation could lead to data breaches or unauthorized changes that could jeopardize your entire project!

Put simply

Think of it like a restaurant where anyone can just walk in and start serving food, regardless of their training or authority. That's how this vulnerability operates—a door that should be locked is wide open! This vulnerability allows improper privilege elevation, meaning that users can gain access levels they shouldn't have, effectively turning a regular user into an admin without proper authorization checks in place.

What to do

An attacker could gain full control over the Atarim platform, allowing them to access sensitive data, change settings, and wreak havoc across your collaboration tools. This level of privilege escalation could lead to data breaches or unauthorized changes that could jeopardize your entire project! Immediately update Atarim to version 4.2.2 or later to fix this vulnerability. Review user roles and permissions to ensure that only authorized personnel have admin access. It’s also a good idea to conduct a security audit to spot any other potential risks. You've got this! Follow these steps to secure your platform, and you'll be back in business in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00421 · 35.4th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-11-06T21:16Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:54Z
    WordPress Atarim plugin <= 4.2.1 - Privilege Escalation vulnerability
    cvelistv5