Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| wpfeedback | Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback | up to 5.1.1 | — | No fix listed | CNA |
- Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback Vendorwpfeedback Affected up to 5.1.1 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-19942
- 2026-10-03 Alias added: GHSA-4mgf-wvrp-c5h9
References
Other 8
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c66a75a3-d420-4f2e-9f61-fe7dc2cb759e?source=cve
- https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/abilities/class-avcf-abilities-media.php#L1212
- https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/abilities/class-avcf-abilities-metadata.php#L1279
- https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Servers/DefaultServerFactory.php#L73
- https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Transport/HttpTransport.php#L99
- https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Abilities/ExecuteAbilityAbility.php#L91
- https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/class-avcf-mcp.php#L329
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3653026%40atarim-visual-collaboration&new=3653026%40atarim-visual-collaboration
More wpfeedback vulnerabilities
- TI-2024-01896 Visual Website Collaboration, Feedback & Project Management – Atarim <= 3.22.6 - Hardcoded Credentials CVSS 3.1HIGH 7.5
- TI-2024-02604 Cross-site scripting in wpfeedback Atarim – Visual Feedback, Review & AI Collaboration CVSS 3.1HIGH 7.2
- TI-2024-07064 Missing authorization in wpfeedback Atarim – Visual Feedback, Review & AI Collaboration CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-19942 · CVE Program
- CVE-2026-19942 · NVD
- FIRST EPSS
- GHSA-4mgf-wvrp-c5h9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences