by Kastro
Paper/Archive/CVE-2026-121379

CVE-2026-121379

Unknown Tournamatch — Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

EPSS 0.1%CVSS 9.6
critical.is priorityof 100
30
CVSS 9.6 (ADP)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 4.2.042 × 200.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

Affected

ProductAffectedFixed inSource
Tournamatch< 4.7.14.7.1CNA

Scores by source

CISA ADP9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

exploitwpscan.com/vulnerability/1caba876-0753-4eaf-9127-455f23be6c9a