Vulnerability · Published Nov 7, 2026 · Assigned by WPScan
CVE-2026-121379Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion
Unrated
In plain English
A security flaw in Tournamatch from Unknown. There are no confirmed reports of exploitation so far.
Severity (CVSS )–Not rated
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Tournamatch | 0 – before 4.7.1 |
References
- https://wpscan.com/vulnerability/1caba876-0753-4eaf-9127-455f23be6c9a/ exploit, vdb-entry, technical-description