---
id: CVE-2026-121379
title: Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion
summary: >-
  The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict
  the path of a previously stored profile or team image before deleting it when
  a new image is uploaded, allowing users with a role as low as Subscriber to
  delete …
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-73
product: Tournamatch
affected:
  - Tournamatch < 4.7.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T18:02:58.161504Z'
published: '2026-11-07'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T18:16:15.605Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121379'
references:
  - url: 'https://wpscan.com/vulnerability/1caba876-0753-4eaf-9127-455f23be6c9a/'
tags:
  - cve.org
epss: 0.0015
epssPercentile: 0.04198
ingestedAt: '2026-11-07T06:11:40.171Z'
---

## Overview

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

## Affected

- `Tournamatch < 4.7.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.