{"affected":[{"defaultStatus":"unaffected","product":"Easy DragDrop File Uploader","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.1.10","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-124822","cwes":["CWE-73"],"description":"The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/2c3537df-1312-442a-816d-904285c0e9c1/"}],"kev":null,"metrics":[],"modifiedAt":1794549609152,"publishedAt":1794549609152,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/2c3537df-1312-442a-816d-904285c0e9c1/"}],"remediation":[],"revision":"4414de99ba37aac37d659286916de98beaf49d4ff2ff8a0d9990116268babb18","sources":[{"modifiedAt":1794549609152,"name":"CNA: WPScan","retrievedAt":1794550152444,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124822"}],"ssvc":null,"status":"published","title":"Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal","updatedAt":1794550152444}