The Atarim plugin for WordPress contains a flaw that fails to validate file paths when deleting media. An authenticated user with author or higher privileges can overwrite the hidden _wp_attached_file meta value with a directory‑traversal string and invoke the replace-media-file ability, causing WordPress to resolve the malicious path and unlink the targeted file. Removing critical files such as wp-config.php can allow an attacker to compromise the site or inject malicious code. The weakness is a path traversal issue (CWE‑22).

WordPress installations that have the Atarim – AI Agency for WordPress plugin version 5.1.1 or earlier are affected. No newer versions have been confirmed to contain the flaw.

The vulnerability scores a CVSS of 8.1, indicating high severity. The EPSS score is not available, and the issue is not in CISA’s KEV catalog. Attackers require authenticated access with author‑level or higher privileges. By leveraging the atarim/update-post-field ability to set a vulnerable meta value and then triggering atarim/replace-media-file, an attacker can delete arbitrary files on the server. The potential impact is significant, especially on sites where author privileges are widely granted.