CVE-2026-121379

Summary

The Tournamatch WordPress plugin before 4.7.1 lacks path validation when deleting user-uploaded profile or team images, allowing low-privileged users (e.g., Subscribers) to specify arbitrary file paths and delete critical server files like wp-config.php. This leads to potential full site compromise by removing configuration needed for site operation or authentication.

Exploitability

Exploitation requires only a Subscriber-level account and knowledge of the target file path; no special tools or privileges beyond standard WordPress login are needed.

Blast radius

Successful exploitation can result in complete site takeover, including database exposure, credential theft, or full remote code execution via wp-config.php deletion and subsequent reconfiguration.

Detection

Defenders should monitor WordPress debug logs and file system change events for unexpected deletions of sensitive files (e.g., wp-config.php) by low-privilege users; also inspect access logs for POST requests to plugin endpoints handling image uploads/deletions from non-administrative roles.

Prioritized remediation

Upgrade to Tournamatch plugin version 4.7.1 or later, which implements proper path validation and restriction for image deletion operations.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.