CVE-2026-19942
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
The Atarim – AI Agency for WordPress plugin up to version 5.1.1 is vulnerable to arbitrary file deletion due to insufficient file path validation. Authenticated attackers with author-level access can delete arbitrary files, potentially leading to remote code execution.
Risk Assessment
Deletion of critical files like wp-config.php could enable remote code execution and full compromise of the WordPress site.
Recommendation
Update the plugin to the latest patched version immediately and restrict user privileges.
Original NVD description (English source)
The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.