Description

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T05:17:02.217Z",
  "pubdate": "2026-08-19T05:17:02.217Z",
  "executiveSummary": "The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is affected by an arbitrary file deletion vulnerability. This flaw stems from insufficient file path validation within the AVCF_Abilities_Media::register (replace-media-file execute_callback) function. The vulnerability impacts all versions up to, and including, 5.1.1.\nAuthenticated attackers possessing author-level access or higher can exploit this security deficiency to delete arbitrary files located on the underlying server. Successful exploitation can easily escalate to remote code execution by targeting critical system files such as wp-config.php.\nThe attack mechanism requires an authenticated context with at least author privileges. Attackers leverage specific plugin capabilities to manipulate attachment metadata using directory traversal sequences, subsequently triggering file resolution and unlinking routines via vulnerable media replacement functions.",
  "technicalDetails": "The vulnerability resides in the AVCF_Abilities_Media::register class, specifically within the execution callback for the replace-media-file functionality. The root cause is the lack of rigorous input validation and sanitization on file paths processed during media replacement operations.\nExploitation requires authenticated access with author-level privileges or higher. The attack flow consists of a multi-step process. First, an attacker utilizes the atarim/update-post-field capability to modify the _wp_attached_file metadata associated with an attacker-owned attachment. This metadata is manipulated to include directory-traversal sequences.\nFollowing the metadata modification, the attacker invokes the atarim/replace-media-file ability. This action forces the application's underlying get_attached_file() function to resolve the path using the tainted traversal sequence, subsequently passing the resolved path to the unlink() function.\nThis behavior allows the deletion of arbitrary files on the server filesystem that the web server process has permissions to remove. Depending on the targeted file, such as wp-config.php, this capability can be leveraged to disrupt application integrity or facilitate remote code execution scenarios."
}