CVE-2026-19942

Deferred Deferred - Pending Action

Arbitrary File Deletion in Atarim WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: Wordfence

Description

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-19942

EUVD

EUVD-2026-62230

Affected Vendors & Products

Vendor	Product	Version / Range
atarim	ai_agency_for_wordpress	to 5.1.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in the Atarim WordPress plugin allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. It occurs due to insufficient file path validation in the plugin's media handling function. Attackers can exploit this by overwriting file metadata with a directory-traversal path, then triggering a file deletion operation that removes critical files like wp-config.php, potentially leading to remote code execution.

Detection Guidance

Check WordPress logs for unauthorized file deletion attempts or suspicious activity in the AVCF_Abilities_Media::register function. Look for patterns involving atarim/update-post-field or atarim/replace-media-file requests. Use commands like grep to search for these patterns in access logs.

Impact Analysis

If exploited, this vulnerability can allow attackers to delete important files on your WordPress server, including configuration files or core system files. This could break your website, cause data loss, or enable further attacks like remote code execution. Attackers might deface your site, steal sensitive data, or take control of your WordPress installation.

Compliance Impact

This vulnerability could lead to unauthorized file deletion or access, violating data integrity and confidentiality requirements under GDPR and HIPAA. If exploited, it may result in unauthorized modifications or loss of protected health information or personal data, potentially leading to regulatory penalties or legal consequences.

Mitigation Strategies

Immediately update the Atarim plugin to the latest version if available. If not, disable the plugin until a patch is released. Review user roles and permissions to ensure no unauthorized users have author-level access or higher. Monitor file system changes and server logs for suspicious activity.

Hi! I’m here to help you understand CVE-2026-19942. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70