CVE-2026-121379
Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.
| Vendor | unknown |
| Product | tournamatch |
| Published | Nov 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown tournamatch
Be the first to know when new unknown vulnerabilities affecting unknown tournamatch are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Tournamatch
0 < 4.7.1
References
Credits
AJA WPScan