CVE-2026-121379

Name of the Vulnerable Software and Affected Versions Tournamatch versions prior to 4.7.1

Description Insufficient validation and restriction of the path for stored profile or team images during the upload of a new image allows users with roles as low as Subscriber to delete arbitrary files on the server. An attacker can delete critical files such as wp-config.php during an avatar reset, which may trigger a re-installation process and lead to a full site takeover.

Recommendations Update to version 4.7.1 or later.