External risk intelligence

Tournamatch WordPress Plugin Arbitrary File Deletion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121379

The vulnerability affects a WordPress plugin, which is typically deployed as part of an internet-facing web application. Since WordPress sites are commonly exposed to the public internet to serve content or interact with users, this attack surface is routinely reachable from the internet in standard deployment configurations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects the Tournamatch WordPress plugin, allowing users with low privileges to delete critical server files, potentially leading to a complete website takeover. The concern is validating if this plugin is in use and exposed to external access.

Plugin allows unauthorized file deletion.
High-impact risk to website integrity.
Confirm use and exposure; assess impact.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by uploading a new profile or team image to a WordPress site. This action triggers the plugin to delete the old image without proper path validation. If the attacker can trick the plugin into deleting critical server files, such as the configuration file, they can gain control of the entire website.

Low-privilege users can trigger it.
Uploading a new image deletes files.
Full site takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the Tournamatch WordPress plugin could allow a low-privileged user to delete arbitrary files on the server. This could affect the integrity and availability of the website, and when combined with other potential misconfigurations or vulnerabilities, could lead to a complete site takeover.

Website files and configuration.
Deleting uploaded images.
Full website takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Tournamatch WordPress plugin allows low-privileged users to delete arbitrary files, potentially leading to a full site takeover. The primary responsibility for addressing this likely falls to the website's application owners or the team managing the WordPress instances. The first practical step is to identify all instances of the Tournamatch plugin, determine their reachability and criticality, and then engage the accountable owner to plan remediation, likely involving vendor coordination for a plugin update.

Application owners should manage this issue.
Verify plugin presence and reachability first.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tournamatch WordPress plugin?

Tournamatch is a WordPress plugin designed for organizing and managing tournaments. Users typically use it to facilitate bracket creation, team management, and athlete profiles directly within their WordPress site environment.

What is the vulnerability in CVE-2026-121379?

The flaw is an Improper Limitation of a Pathname to a Restricted Directory, classified as CWE-73. It means the plugin lacks security checks when processing file paths, allowing an attacker to target and remove sensitive system files instead of just deleting old images.

How does an attacker trigger this file deletion?

The bug triggers during the image upload process. When a user uploads a new profile or team image, the plugin attempts to delete the previous file. It does not verify the path, so providing a malicious file path instead of a standard image path can cause the server to delete that target file. Simply browsing the site does not trigger this.

Is my site at risk if I use Tournamatch?

According to Halo Surface Signal, this plugin is frequently deployed on internet-facing WordPress sites, making it highly reachable for external actors. If your instance is public, a registered user with even low-level subscriber permissions could potentially execute this action.

What should I do if I have Tournamatch installed?

First, audit your WordPress installations to confirm if Tournamatch is present and identify which sites are publicly accessible. Once located, verify your current plugin version. Check the vendor's resources for an update to version 4.7.1 or higher to patch this path validation defect.

References

wpscan.com/vulnerability/1caba876-0753-4eaf-9127-455f23be6c9a/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.