CVE-2026-19942 Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta
Authenticated attackers can delete arbitrary files via path traversal, potentially leading to remote code execution by deleting critical configuration files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19942?
CVE-2026-19942 is a high-severity path traversal vulnerability in wpfeedback Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback, published on 19 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.
Weakness: CWE-22
Which versions are affected by CVE-2026-19942?
How do I fix CVE-2026-19942?
No fix has been published for CVE-2026-19942 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-19942 being exploited?
There is no known exploitation of CVE-2026-19942 in the wild and no public exploit code.
Sources
Also known as GHSA-4mgf-wvrp-c5h9.