{"affected":[{"defaultStatus":"unaffected","product":"Tournamatch","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.7.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-121379","cwes":["CWE-73"],"description":"The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/1caba876-0753-4eaf-9127-455f23be6c9a/"}],"kev":null,"metrics":[],"modifiedAt":1794031226543,"publishedAt":1794031226543,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/1caba876-0753-4eaf-9127-455f23be6c9a/"}],"remediation":[],"revision":"7ab512daf3d8a1f3acbfe170bb182e649981e32244a171a3892399cae68ca48b","sources":[{"modifiedAt":1794031226543,"name":"CNA: WPScan","retrievedAt":1794031724284,"url":"https://www.cve.org/CVERecord?id=CVE-2026-121379"}],"ssvc":null,"status":"published","title":"Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion","updatedAt":1794031724284}