CVE-2026-121379: Tournamatch WordPress Plugin File Deletion

CVE-2026-121379 affects Tournamatch, a widely used WordPress plugin for managing tournaments and competitions. The vulnerability is an arbitrary file deletion: the plugin allows any user with Subscriber role (the lowest, often assigned to moderators, players or participants) to delete arbitrary files on the server when uploading profile or team images. It does not validate the path of the file to be deleted, making it possible to delete critical files such as wp-config.php, plugin configs, backups and any other file accessible by the PHP process.

The CVSS score is 9.6 Critical. The vulnerability was publicly disclosed on November 7, 2026 on NVD. Signals on X show two posts in the last 24 hours with 5 total interactions: discussion level still low but consistent with a brand-new vulnerability. The patch is available immediately: version 4.7.1 fixes the flaw. No public exploit has been reported, but given the simplicity and criticality of the vulnerability, attention among researchers is high.

If you manage a WordPress site with Tournamatch: verify the current version (Dashboard > Plugins), if below 4.7.1 update immediately via the dashboard, after update verify that image upload functions work properly. If you do not use Tournamatch, disregard this alert. For CISOs and IT teams: include Tournamatch in patch management monitoring and consider checking access logs and file deletion logs in recent days for any suspicious activity.