CVE-2024-2038

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.22.6. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for unauthenticated attackers to modify plugin settings, delete posts, modify post titles, and upload images.

• CWE-259

• https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/3.18/inc/wpf_api.php
• https://plugins.trac.wordpress.org/changeset?old=3076514&old_path=atarim-visual-collaboration%2Ftrunk%2Fatarim-visual-collaboration.php&new=3090249&new_path=atarim-visual-collaboration%2Ftrunk%2Fatarim-visual-collaboration.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/29532f4d-e830-4c99-ad77-076eebbbe98d?source=cve
• https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/3.18/inc/wpf_api.php
• https://plugins.trac.wordpress.org/changeset?old=3076514&old_path=atarim-visual-collaboration%2Ftrunk%2Fatarim-visual-collaboration.php&new=3090249&new_path=atarim-visual-collaboration%2Ftrunk%2Fatarim-visual-collaboration.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/29532f4d-e830-4c99-ad77-076eebbbe98d?source=cve

Published

May 23, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-20374A vulnerability in the web-based management interface of Cis…7.2
• CVE-2024-20375A vulnerability in the SIP call processing function of Cisco…7.5
• CVE-2024-20376A vulnerability in the web-based management interface of Cis…7.5
• CVE-2024-20377A vulnerability in the web-based management interface of Cis…5.4
• CVE-2024-20378A vulnerability in the web-based management interface of Cis…7.5
• CVE-2024-20379A vulnerability in the web-based management interface of Cis…6.5
• CVE-2024-20380A vulnerability in the HTML parser of ClamAV could allow an …7.5
• CVE-2024-20381A vulnerability in the JSON-RPC API feature in Cisco Crosswo…8.8
• CVE-2024-20382A vulnerability in the VPN web client services feature of Ci…6.1
• CVE-2024-20383A vulnerability in the web-based management interface of Cis…8.4
• CVE-2024-20384A vulnerability in the Network Service Group (NSG) feature o…5.8
• CVE-2024-20385A vulnerability in the SSL/TLS implementation of Cisco Nexus…5.9