CVE-2026-121379: Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

Q: Who can exploit this issue?

Any authenticated user with the Subscriber role or higher can exploit it. Affected sites are WordPress installations running a Tournamatch version earlier than 4.7.1.

Q: What does an attacker need to do to trigger the deletion?

The attacker needs to control the previously stored path for a profile or team image and then upload a new image. The plugin deletes the prior image path without validating or restricting it.

Q: What is the potential impact?

An attacker can delete arbitrary server files, including files such as wp-config.php. This can lead to full site takeover.

Q: What should be done if the site is affected?

Update Tournamatch to version 4.7.1 or later. The provided information does not describe an alternative workaround if updating cannot be performed immediately.

Published Nov 7, 2026

Updated

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tournamatch WordPress plugin to a version that resolves this vulnerability.
Fixed in 4.7.1

Event History

Nov 7, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:16 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any authenticated user with the Subscriber role or higher can exploit it. Affected sites are WordPress installations running a Tournamatch version earlier than 4.7.1.

What does an attacker need to do to trigger the deletion?

The attacker needs to control the previously stored path for a profile or team image and then upload a new image. The plugin deletes the prior image path without validating or restricting it.

What is the potential impact?

An attacker can delete arbitrary server files, including files such as wp-config.php. This can lead to full site takeover.

What should be done if the site is affected?

Update Tournamatch to version 4.7.1 or later. The provided information does not describe an alternative workaround if updating cannot be performed immediately.

CVE-2026-121379: Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to trigger the deletion?

What is the potential impact?

What should be done if the site is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to trigger the deletion?

What is the potential impact?

What should be done if the site is affected?