CVE-2025-22657
Published: 18 February 2025
Summary
CVE-2025-22657 is a high-severity Missing Authorization (CWE-862) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-3 enforces approved authorizations for access to system resources, directly preventing unauthenticated arbitrary content deletion due to missing authorization.
SI-2 mandates timely identification, reporting, and correction of flaws like this plugin vulnerability, eliminating the missing authorization issue through patching.
AC-6 enforces least privilege, limiting unauthorized users' ability to perform high-impact actions such as content deletion even if authorization is bypassed.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization in public-facing WordPress plugin directly enables T1190 for remote unauthenticated exploitation and facilitates T1485 through arbitrary content deletion causing DoS.
NVD Description
Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.0.9.
Deeper analysisAI
CVE-2025-22657 is a missing authorization vulnerability (CWE-862) in the Atarim Visual Collaboration WordPress plugin by Vito Peleg. The issue allows exploiting incorrectly configured access control security levels and affects all versions of Atarim from n/a through 4.0.9. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its potential for significant availability disruption without privileges or user interaction.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity. Exploitation enables arbitrary content deletion, leading to high-impact denial of service on affected WordPress sites by disrupting access to or integrity of site content.
The Patchstack advisory identifies this as an arbitrary content deletion vulnerability in the WordPress Atarim plugin up to version 4.0.9 and provides details on the issue. Security practitioners should consult the advisory at https://patchstack.com/database/Wordpress/Plugin/atarim-visual-collaboration/vulnerability/wordpress-atarim-plugin-4-0-9-arbitrary-content-deletion-vulnerability?_s_id=cve for recommended mitigations.
Details
- CWE(s)