PULSE
ENPT
FEED
ransommetaencryptor reclama a Christie Digital Systems · US · Technologyransommetaencryptor reclama a Daeah E&C · KR · Manufacturingransommetaencryptor reclama a DAEWON Chemical · KR · Manufacturingransommetaencryptor reclama a Wooshin Systems · KR · Technologyransommetaencryptor reclama a Proterial America, Ltd. · US · Manufacturingransommetaencryptor reclama a Hyundai E&C · KR · Manufacturingransommetaencryptor reclama a Pekin Insurance · US · Financial Servicesransomn0n reclama a Staples, Inc. / SBD Inc. · US · Retail & E-Commerceransomn0n reclama a Lampenwelt GmbH · DE · Retail & E-Commerceransomn0n reclama a Infutor Data Solutions · US · Technologyransomn0n reclama a Higginbotham · US · Professional Servicesransomrhysida reclama a Treuhand & Immobilien Abt AG · CH · Financial Servicesransomwhitearmor reclama a maersk · DK · Transportationransomqilin reclama a Acondistec · DE · Manufacturingransommetaencryptor reclama a Christie Digital Systems · US · Technologyransommetaencryptor reclama a Daeah E&C · KR · Manufacturingransommetaencryptor reclama a DAEWON Chemical · KR · Manufacturingransommetaencryptor reclama a Wooshin Systems · KR · Technologyransommetaencryptor reclama a Proterial America, Ltd. · US · Manufacturingransommetaencryptor reclama a Hyundai E&C · KR · Manufacturingransommetaencryptor reclama a Pekin Insurance · US · Financial Servicesransomn0n reclama a Staples, Inc. / SBD Inc. · US · Retail & E-Commerceransomn0n reclama a Lampenwelt GmbH · DE · Retail & E-Commerceransomn0n reclama a Infutor Data Solutions · US · Technologyransomn0n reclama a Higginbotham · US · Professional Servicesransomrhysida reclama a Treuhand & Immobilien Abt AG · CH · Financial Servicesransomwhitearmor reclama a maersk · DK · Transportationransomqilin reclama a Acondistec · DE · Manufacturing
← Todos los CVEs
CVE Watch7 nov 2026

CVE-2026-121379

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before del

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 7 nov 2026 · Última mod.: 7 nov 2026

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

Referencias oficiales
CVEs relacionados

Sin CVEs relacionados por CWE o producto.