CVE-2025-9517 is a high-severity vulnerability in the docjojo atec Debug WordPress plugin (up to version 1.2.22) that allows authenticated administrators to execute arbitrary code remotely. The issue arises from improper sanitization of the 'custom_log' parameter used when saving the custom log path, leading to code injection (CWE-94). This vulnerability can be exploited by users with elevated privileges to run malicious code on the affected server. The CVSS 3.1 base score is 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No official patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows authenticated users with Administrator-level access or higher to execute arbitrary code on the server hosting the WordPress site. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability requires high privileges to exploit and does not involve user interaction beyond authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the atec Debug plugin. Consider disabling or removing the plugin if it is not essential to reduce risk.