CVE-2026-19942

🗓️ 19 Aug 2026 04:27:08Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 71 Views🌐 WEB

Atarim plugin up to 5.1.1 allows authenticated authors to delete arbitrary server files via _wp_attached_file path traversal.

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2026-19942	19 Aug 202606:00	–	circl
Cvelist	CVE-2026-19942 Atarim <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta	19 Aug 202604:27	–	cvelist
EUVD	EUVD-2026-62230	19 Aug 202604:27	–	euvd
NVD	CVE-2026-19942	19 Aug 202605:17	–	nvd
Patchstack	WordPress Atarim plugin <= 5.1.1 - Authenticated (Author+) Arbitrary File Deletion via '_wp_attached_file' Meta vulnerability	20 Aug 202611:03	–	patchstack
Positive Technologies	PT-2026-78267	19 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-19942: Improper Limitation of a Pathname to a Restricted Directory	19 Aug 202600:00	–	rapid7

Vulners

Node

atarim wpfeedbackRange≤5.1.1wordpress

[
  {
    "vendor": "wpfeedback",
    "product": "Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.1.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Transport/HttpTransport.php
plugins	www.plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Abilities/ExecuteAbilityAbility.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/c66a75a3-d420-4f2e-9f61-fe7dc2cb759e
plugins	www.plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/abilities/class-avcf-abilities-metadata.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Servers/DefaultServerFactory.php
plugins	www.plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/class-avcf-mcp.php
plugins	www.plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/abilities/class-avcf-abilities-media.php

Parameter	Position	Path	Description	CWE
_wp_attached_file	request body	/atarim/update-post-field	Overwrites the _wp_attached_file meta of an attachment with a directory traversal path, enabling arbitrary file deletion when paired with replace-media-file.	CWE-22
attachment_id	request body	/atarim/replace-media-file	Triggers deletion of a targeted file by resolving the manipulated attachment path via get_attached_file() during replace-media-file.	CWE-22

20 Aug 2026 16:17Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.1

EPSS0.01083

CWE-22