{"id":"CVE-2026-121379","published":"2026-11-07T06:16:58.040","lastModified":"2026-11-10T16:28:46.510","description":"The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H","cwes":["CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/1caba876-0753-4eaf-9127-455f23be6c9a/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Tournamatch WordPress plugin before 4.7.1 lacks path validation when deleting user-uploaded profile or team images, allowing low-privileged users (e.g., Subscribers) to specify arbitrary file paths and delete critical server files like wp-config.php. This leads to potential full site compromise by removing configuration needed for site operation or authentication.","exploitability":"Exploitation requires only a Subscriber-level account and knowledge of the target file path; no special tools or privileges beyond standard WordPress login are needed.","blast_radius":"Successful exploitation can result in complete site takeover, including database exposure, credential theft, or full remote code execution via wp-config.php deletion and subsequent reconfiguration.","remediation":"Upgrade to Tournamatch plugin version 4.7.1 or later, which implements proper path validation and restriction for image deletion operations.","detection":"Defenders should monitor WordPress debug logs and file system change events for unexpected deletions of sensitive files (e.g., wp-config.php) by low-privilege users; also inspect access logs for POST requests to plugin endpoints handling image uploads/deletions from non-administrative roles.","tags":["path-traversal","file-deletion","privilege-escalation","wordpress","web-app"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:46:43.989Z"}}