Attack Chain

1. Attacker authenticates to the target WordPress site with an account possessing at least author-level privileges.
2. Attacker performs a media upload or selects an existing attachment owned by their user account.
3. Attacker sends a request to the atarim/update-post-field endpoint to modify the _wp_attached_file metadata for the attachment.
4. The attacker includes a directory traversal payload (e.g., ../../../../wp-config.php) within the metadata field.
5. Attacker invokes the atarim/replace-media-file action via the plugin's REST API or callback mechanism.
6. The execute_callback function triggers get_attached_file() using the manipulated metadata path.
7. The application executes unlink() on the resolved path, resulting in the permanent deletion of the targeted system file from the disk.
8. Attacker leverages the deleted file state (e.g., re-running the WordPress installer due to a missing configuration) to gain unauthorized control or RCE.

Impact

Successful exploitation allows for the deletion of critical WordPress configuration and core files. In the context of a WordPress environment, the removal of wp-config.php forces the site into an initial setup state, enabling an attacker to re-initialize the database connection to an attacker-controlled instance or perform unauthorized administrative actions. This vulnerability impacts any WordPress site running Atarim AI Agency for WordPress version 5.1.1 or lower.

Recommendation

• Immediately update the Atarim - AI Agency for WordPress plugin to a patched version (5.1.2 or later).
• Review administrative and author-level user accounts for recent anomalous activity or unauthorized file manipulation requests.
• Monitor web server logs for suspicious POST requests to atarim/update-post-field or atarim/replace-media-file endpoints that contain directory traversal patterns (e.g., ../).
• Implement file integrity monitoring (FIM) on critical application files, specifically wp-config.php, to alert on unexpected deletion events.