{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-19942/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-19942"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Atarim – AI Agency for WordPress"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","directory-traversal","cve-2026-19942"],"_cs_type":"advisory","_cs_vendors":["Atarim"],"content_html":"\u003cp\u003eThe Atarim - AI Agency for WordPress plugin (versions 5.1.1 and below) contains a critical vulnerability due to insufficient file path validation within the \u003ccode\u003eAVCF_Abilities_Media::register\u003c/code\u003e function. This flaw, identified as CVE-2026-19942, allows authenticated attackers with author-level permissions or higher to perform arbitrary file deletion on the hosting server. By leveraging directory traversal techniques through the \u003ccode\u003eatarim/update-post-field\u003c/code\u003e ability, an attacker can manipulate the \u003ccode\u003e_wp_attached_file\u003c/code\u003e metadata of an attachment they control. Subsequent invocation of the \u003ccode\u003eatarim/replace-media-file\u003c/code\u003e function forces the server to resolve the manipulated path and execute an \u003ccode\u003eunlink()\u003c/code\u003e operation on the targeted file. Deleting critical system files such as \u003ccode\u003ewp-config.php\u003c/code\u003e may cause the application to revert to an unconfigured state, facilitating further exploitation or remote code execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the target WordPress site with an account possessing at least author-level privileges.\u003c/li\u003e\n\u003cli\u003eAttacker performs a media upload or selects an existing attachment owned by their user account.\u003c/li\u003e\n\u003cli\u003eAttacker sends a request to the \u003ccode\u003eatarim/update-post-field\u003c/code\u003e endpoint to modify the \u003ccode\u003e_wp_attached_file\u003c/code\u003e metadata for the attachment.\u003c/li\u003e\n\u003cli\u003eThe attacker includes a directory traversal payload (e.g., \u003ccode\u003e../../../../wp-config.php\u003c/code\u003e) within the metadata field.\u003c/li\u003e\n\u003cli\u003eAttacker invokes the \u003ccode\u003eatarim/replace-media-file\u003c/code\u003e action via the plugin's REST API or callback mechanism.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eexecute_callback\u003c/code\u003e function triggers \u003ccode\u003eget_attached_file()\u003c/code\u003e using the manipulated metadata path.\u003c/li\u003e\n\u003cli\u003eThe application executes \u003ccode\u003eunlink()\u003c/code\u003e on the resolved path, resulting in the permanent deletion of the targeted system file from the disk.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the deleted file state (e.g., re-running the WordPress installer due to a missing configuration) to gain unauthorized control or RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the deletion of critical WordPress configuration and core files. In the context of a WordPress environment, the removal of \u003ccode\u003ewp-config.php\u003c/code\u003e forces the site into an initial setup state, enabling an attacker to re-initialize the database connection to an attacker-controlled instance or perform unauthorized administrative actions. This vulnerability impacts any WordPress site running Atarim AI Agency for WordPress version 5.1.1 or lower.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Atarim - AI Agency for WordPress plugin to a patched version (5.1.2 or later).\u003c/li\u003e\n\u003cli\u003eReview administrative and author-level user accounts for recent anomalous activity or unauthorized file manipulation requests.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003eatarim/update-post-field\u003c/code\u003e or \u003ccode\u003eatarim/replace-media-file\u003c/code\u003e endpoints that contain directory traversal patterns (e.g., \u003ccode\u003e../\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eImplement file integrity monitoring (FIM) on critical application files, specifically \u003ccode\u003ewp-config.php\u003c/code\u003e, to alert on unexpected deletion events.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T06:58:31Z","date_published":"2026-08-19T06:58:31Z","id":"https://feed.craftedsignal.io/briefs/2026-08-atarim-wordpress-file-deletion/","summary":"The Atarim - AI Agency for WordPress plugin is vulnerable to arbitrary file deletion via directory traversal, enabling attackers with author-level access to delete sensitive files and potentially achieve remote code execution.","title":"Arbitrary File Deletion in Atarim AI Agency for WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-08-atarim-wordpress-file-deletion/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-19942","version":"https://jsonfeed.org/version/1.1"}