https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-09T14:56:14.342800+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-121379 fkie_cve-2026-121379 2026-11-09T14:56:14.344259+00:00

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.

 https://db.gcve.eu/vuln/ghsa-6hvc-jpr4-hmmg GHSA-6hvc-jpr4-hmmg 2026-11-09T14:56:14.344322+00:00

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subscriber to delete arbitrary files on the server, such as wp-config.php, which can lead to a full site takeover.