Skip to content

CVE-2026-121379 Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

CriticalCVSS 9.6
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

Affected products

No affected product data has been published yet.

References

  • wpscan.com exploit technical-description vdb-entry