The Atarim WordPress plugin (version 4.2.1 and earlier) has an unrestricted file upload flaw that allows any file type to be uploaded without validation. This weakness, identified as CWE-434, means an attacker could place malicious code on the server, which may be executed if the file is of an executable type or if the server incorrectly interprets the file. The result is a potential escalation of privileges and compromise of the host where the WordPress site is running.

All sites running the Vito Peleg Atarim plugin at version 4.2.1 or before are vulnerable. The issue exists within the plugin’s upload functionality, so any WordPress installation with the affected Atarim plugin is at risk.

The CVSS score of 4.8 indicates a moderate severity, and the EPSS score of less than 1% points to a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Based on the information, the likely attack vector is a web‑based upload endpoint accessed through the WordPress admin interface, and it would require the attacker to have sufficient permission to use that upload function or to circumvent authentication controls.