Atarim Ai Agency For Wordpress
Monthly
Arbitrary file deletion in the Atarim AI Agency for WordPress plugin (all versions through 5.1.1) allows authenticated attackers holding author-level credentials to delete any file on the underlying server via a chained directory traversal attack, with a direct path to remote code execution. The exploit chain poisons WordPress attachment metadata with a traversal path and then triggers the plugin's media replacement workflow to resolve and unlink the attacker-chosen target file. No public exploit has been identified at time of analysis, but the Wordfence advisory fully documents the two-step chain against verified source code, making independent reproduction straightforward for a moderately skilled attacker.
Arbitrary file deletion in the Atarim AI Agency for WordPress plugin (all versions through 5.1.1) allows authenticated attackers holding author-level credentials to delete any file on the underlying server via a chained directory traversal attack, with a direct path to remote code execution. The exploit chain poisons WordPress attachment metadata with a traversal path and then triggers the plugin's media replacement workflow to resolve and unlink the attacker-chosen target file. No public exploit has been identified at time of analysis, but the Wordfence advisory fully documents the two-step chain against verified source code, making independent reproduction straightforward for a moderately skilled attacker.