The atec Debug plugin for WordPress (docjojo) contains an absolute path traversal vulnerability (CWE-36) in versions up to 1.2.22. Authenticated attackers with Administrator or higher privileges can exploit the 'custom_log' parameter to read arbitrary files outside the plugin's intended directory. This vulnerability could lead to unauthorized disclosure of sensitive file contents. The CVSS 3.1 base score is 4.9 (medium severity), with network attack vector, low attack complexity, and high privileges required. No evidence of active exploitation is currently known, and no patch or remediation details have been provided.

Successful exploitation allows an attacker with Administrator-level access to read arbitrary files on the server, potentially exposing sensitive information. This does not affect integrity or availability but compromises confidentiality. The vulnerability requires high privileges, limiting the attack scope to already trusted users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for unusual file access patterns related to the 'custom_log' parameter. No official patch or workaround has been published at this time.