The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF_Abilities_Media::register (replace-media-file execute_callback) function in all versions up to, and including, 5.1.1. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable by first using the atarim/update-post-field ability to overwrite the _wp_attached_file meta of an attacker-owned attachment with a directory-traversal path, then invoking atarim/replace-media-file to cause get_attached_file() to resolve and unlink the targeted file.
CVE-2026-19942
Score 8.1 from GitHub Security Advisory (severity: HIGH) published 2026-08-19. a secondary CVSS source baseline 8.1; sources differ by 0.0.
- High severity, but no confirmed exploitation yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 8.1
- EG Score
- 8.1(high)
- EG Risk
- 41(Track)EG Risk 41/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity81% × 45%Exploitation1% × 40%Automatability30% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 1%
- EPSS %ILE
- 50%
- KEV
- Not listed
Published
August 19, 2026
Last Modified
August 19, 2026
References (8)
- security@wordfencehttps://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/abilities/class-avcf-abilities-media.php#L1212
- security@wordfencehttps://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/abilities/class-avcf-abilities-metadata.php#L1279
- security@wordfencehttps://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/doit/class-avcf-mcp.php#L329
- security@wordfencehttps://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Abilities/ExecuteAbilityAbility.php#L91
- security@wordfencehttps://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Servers/DefaultServerFactory.php#L73
- security@wordfencehttps://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/tags/5.1.1/vendor/wordpress/mcp-adapter/includes/Transport/HttpTransport.php#L99
- security@wordfencehttps://plugins.trac.wordpress.org/changeset?reponame=&old=3653026%40atarim-visual-collaboration&new=3653026%40atarim-visual-collaboration
- security@wordfencehttps://www.wordfence.com/threat-intel/vulnerabilities/id/c66a75a3-d420-4f2e-9f61-fe7dc2cb759e?source=cve
Vendor Advisories for CVE-2026-19942(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 7× in last 7d / 7× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-08-20 07:39 UTCGHSA enrichment
- 2026-08-19 18:28 UTCEG score recompute
- 2026-08-19 18:28 UTCGHSA enrichment
- 2026-08-19 17:03 UTCEPSS rescore
- 2026-08-19 05:19 UTCEG score recompute
- 2026-08-19 04:44 UTCEG score recompute
- 2026-08-19 04:42 UTCMITRE cvelistV5first tracked
Related CVEs(same CWE)
Frequently asked(5)
What is CVE-2026-19942?
When was CVE-2026-19942 disclosed?
Is CVE-2026-19942 actively exploited?
What is the CVSS score of CVE-2026-19942?
How do I remediate CVE-2026-19942?
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-19942
Is Your Infrastructure Affected by CVE-2026-19942?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.