CVE-2024-12104 is a missing authorization vulnerability (CWE-862) in the Atarim WordPress plugin for visual website collaboration and feedback. The issue arises because the wpf_delete_file functions do not perform proper capability checks, enabling unauthenticated attackers to delete project-related pages and files. This affects all versions up to and including 4.0.9. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily on integrity due to unauthorized deletion of data. There is no vendor advisory or patch information available at this time.

An attacker without authentication can delete project pages and files within the affected plugin, leading to unauthorized loss of data integrity. There is no reported impact on confidentiality or availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionality and monitor for suspicious activity related to project file deletions. Avoid exposing the plugin to untrusted users or public access where possible.