Arbitrary File Deletion via Unvalidated Image Path Handling

The Tournamatch WordPress plugin vulnerability allows attackers to delete arbitrary files on a web server through improper validation of image file paths. When users upload new profile or team images, the plugin fails to sanitize or restrict the deletion path of previously stored images, enabling even low-privileged Subscriber accounts to target critical files like wp-config.php. This represents a severe privilege escalation and file system manipulation vulnerability that can result in complete site compromise, as deletion of configuration files exposes database credentials and disables core WordPress functionality. The vulnerability affects any WordPress installation running the vulnerable plugin version, making it an attractive target for attackers seeking rapid site takeover with minimal account privileges.

While MITRE ATT&CK mapping is currently unavailable for this CVE, Casky practitioners would detect the attack patterns underlying this vulnerability through skills focused on CWE-73 (External Control of File Name or Path) detection and exploitation. The platform's 754 security skills would surface findings related to improper input validation, path traversal risks, and file system access control weaknesses. Practitioners using Claude AI with extended reasoning capabilities would identify suspicious patterns such as image upload requests containing path manipulation sequences, unexpected file deletion operations originating from low-privilege accounts, and anomalous file system access targeting configuration files. Security teams monitoring WordPress plugin behavior would receive alerts on privilege escalation attempts via file manipulation and post-exploitation indicators like disappeared configuration files or filesystem permission changes occurring immediately after image upload operations.