CVE-2026-124822: Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal
The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Easy DragDrop File Uploaderto a version that resolves this vulnerability.Fixed in 1.1.10
Event History
Frequently Asked Questions
Which sites are exposed?
WordPress sites using Easy DragDrop File Uploader versions earlier than 1.1.10 are exposed. No authentication is required to exploit the issue.
What can an attacker delete?
An attacker can supply a path traversal value to delete arbitrary files and directories on the server. The affected files can include wp-config.php.
What should be done if the plugin cannot be updated immediately?
The provided data does not identify a workaround. Because exploitation is unauthenticated, removing or disabling the affected plugin would reduce exposure until version 1.1.10 or later can be deployed.