CVE-2026-19942

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.

• CWE-22

• https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/abilities/class-avcf-abilities-media.php#L1212
• https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/abilities/class-avcf-abilities-metadata.php#L1279
• https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/class-avcf-mcp.php#L329
• https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Abilities/ExecuteAbilityAbility.php#L91
• https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Servers/DefaultServerFactory.php#L73
• https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Transport/HttpTransport.php#L99
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3653026%40atarim-visual-collaboration&new=3653026%40atarim-visual-collaboration
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c66a75a3-d420-4f2e-9f61-fe7dc2cb759e?source=cve

Published

Aug 19, 2026

Last Modified

Aug 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19931A flaw in libcurl makes it wrongly reuse an HTTP connection …9.8
• CVE-2026-19932A security flaw has been discovered in DefaultFuction Notice…6.3
• CVE-2026-19933A weakness has been identified in DefaultFuction Customer-Re…6.3
• CVE-2026-19934A vulnerability has been found in itsourcecode Hospital Mana…6.3
• CVE-2026-1994The s2Member plugin for WordPress is vulnerable to privilege…9.8
• CVE-2026-19941An inapplicable NSEC record may be accepted by a `named` res…5.9
• CVE-2026-19943The Gutenverse – WordPress Blocks, Page Builder & Site Edito…6.4
• CVE-2026-19944The WP Crowdfunding plugin for WordPress is vulnerable to ge…4.9
• CVE-2026-19945The WP Crowdfunding plugin for WordPress is vulnerable to St…6.4
• CVE-2026-19946The Awesome Support plugin for WordPress is vulnerable to Mi…4.3
• CVE-2026-19948The Cozy Blocks – Page Builder for Gutenberg Editor & FSE wi…5.3
• CVE-2026-19949The All-in-One WP Migration and Backup plugin for WordPress …8.8