CVE-2026-19942

Name of the Vulnerable Software and Affected Versions Atarim – AI Agency for WordPress versions prior to 5.1.2

Description Insufficient file path validation in the AVCF Abilities Media::register (replace-media-file execute callback) function allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. This can be achieved by using the atarim/update-post-field ability to overwrite the wp attached file meta of an attacker-owned attachment with a directory-traversal path, and then invoking atarim/replace-media-file to trigger the get attached file() function to resolve and unlink the targeted file. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update to a version newer than 5.1.1.