Threats tagged 'ghsa-6hvc-jpr4-hmmg'

The Tournamatch WordPress plugin versions prior to 4.7.1 contain a vulnerability where the plugin does not validate or restrict the path of a previously stored profile or team image before deleting it during a new image upload. This flaw allows users with minimal privileges, such as Subscribers, to delete arbitrary files on the server, including critical files like wp-config.php, potentially leading to a full site takeover.