CVE-2026-19942: Atarim WordPress Path Traversal Flaw

CVE-2026-19942 Overview

CVE-2026-19942 affects the Atarim – AI Agency for WordPress plugin (also known as Atarim Visual Collaboration) in all versions up to and including 5.1.1. The vulnerability allows authenticated attackers with author-level access to delete arbitrary files on the underlying server. The flaw resides in the AVCF_Abilities_Media::register function, specifically in the replace-media-file execute callback, which performs insufficient file path validation [CWE-22]. Deletion of critical files such as wp-config.php can escalate to remote code execution by triggering WordPress into a setup state that attackers control.

Critical Impact
Authenticated author-level attackers can traverse directories and delete arbitrary server files, enabling remote code execution through wp-config.php removal.

Affected Products

Atarim – AI Agency for WordPress plugin (atarim-visual-collaboration) versions ≤ 5.1.1
WordPress installations with author-level or higher user accounts
All hosting environments running the vulnerable plugin build

Discovery Timeline

2026-08-19 - CVE-2026-19942 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-19942

Vulnerability Analysis

The Atarim plugin exposes a Model Context Protocol (MCP) surface that maps named abilities to executable callbacks. Two abilities are relevant: atarim/update-post-field and atarim/replace-media-file. Neither ability validates that the resolved file path stays within the WordPress uploads directory.

An attacker with author privileges first uploads an attachment they own. Using atarim/update-post-field, the attacker overwrites the _wp_attached_file post meta of that attachment with a directory-traversal string such as ../../../../wp-config.php. Invoking atarim/replace-media-file then calls WordPress's get_attached_file() on the poisoned attachment. The function returns the traversed absolute path, which the callback subsequently passes to unlink().

Because the deletion targets arbitrary paths outside the uploads directory, attackers can remove wp-config.php, plugin files, or other application resources. Deleting wp-config.php puts WordPress into an installation state where an unauthenticated actor can point the site at a database they control and stage arbitrary PHP execution.

Root Cause

The root cause is missing canonicalization and boundary enforcement on the _wp_attached_file meta value consumed by the media replacement ability. The plugin trusts attacker-controlled post meta as a safe relative path and does not confine the resolved absolute path to the uploads directory before invoking file operations.

Attack Vector

The attack is remote and network-accessible over HTTP through the plugin's MCP HTTP transport. Exploitation requires an authenticated account with author-level capabilities or higher. No user interaction is required.

See the Wordfence Vulnerability Analysis and the WordPress Plugin Abilities Media source for the vulnerable code paths.

Detection Methods for CVE-2026-19942

Indicators of Compromise

HTTP POST requests to the plugin's MCP transport endpoint invoking the atarim/update-post-field ability with _wp_attached_file meta values containing ../ sequences.
Sequential MCP calls where atarim/update-post-field is immediately followed by atarim/replace-media-file targeting the same post_id.
Missing or truncated wp-config.php, sudden WordPress installation redirects, or PHP fatal errors referencing missing core files.
Author-role accounts issuing MCP ability calls outside typical editorial workflows.

Detection Strategies

Inspect webserver access logs for the plugin's MCP HTTP transport route and flag payloads containing traversal sequences in JSON bodies.
Enable WordPress database auditing on postmeta updates where meta_key='_wp_attached_file' and the value contains ../ or absolute paths.
Monitor filesystem events on the WordPress document root for unlink operations affecting files outside wp-content/uploads/.

Monitoring Recommendations

Alert on any modification or deletion of wp-config.php, .htaccess, and core WordPress PHP files.
Correlate author-level authentication events with MCP ability invocations to surface anomalous API usage.
Track HTTP 500 responses and installation-wizard redirects that follow suspicious plugin activity.

How to Mitigate CVE-2026-19942

Immediate Actions Required

Update the Atarim plugin to a version released after 5.1.1 that addresses the file path validation gap. Review the WordPress Plugin Changeset for fix details.
If a patched version is unavailable, deactivate and remove the Atarim Visual Collaboration plugin from all WordPress sites.
Audit author-level and higher accounts for legitimacy and rotate credentials on suspicion of compromise.
Verify the integrity of wp-config.php and other WordPress core files from a known-good backup.

Patch Information

A fix is referenced in the plugin's trac changeset 3653026. Administrators should install the vendor-released patched build once it is published and confirm the plugin version reported by WordPress exceeds 5.1.1.

Workarounds

Restrict author-level and contributor roles to trusted users only until patched, since exploitation requires an authenticated account.
Deploy a web application firewall rule that blocks JSON request bodies containing _wp_attached_file values with ../ traversal sequences.
Enforce filesystem permissions that prevent the PHP process from writing outside wp-content/, limiting the blast radius of arbitrary deletion.
Disable the plugin's MCP HTTP transport endpoint at the reverse proxy if the AI collaboration features are not in active use.

bash

# Example nginx rule to block traversal in Atarim MCP payloads
location ~* /wp-json/atarim/ {
    if ($request_body ~* "_wp_attached_file.*\.\./") {
        return 403;
    }
}