Tournamatch vulnerabilities
CVEs whose affected-version data names the Tournamatch package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-121379Critical· 9.6Tournamatch < 4.7.1 - Subscriber+ Arbitrary File Deletion
The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete …
▾ MidnightEPSS 0.15%via CVEORG
CVE-2026-121380Medium· 5.3Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API
The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
▾ SunlitEPSS 0.16%via CVEORG