Vulnerability · Published Nov 7, 2026 · Assigned by WPScan
CVE-2026-121379Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion
Critical 9.6
In plain English
A critical-severity security flaw in Tournamatch from Unknown. There are no confirmed reports of exploitation so far.
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)–no EPSS score yet
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Tournamatch | 0 – before 4.7.1 |
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
References
- https://wpscan.com/vulnerability/1caba876-0753-4eaf-9127-455f23be6c9a/ exploit, vdb-entry, technical-description