WordPress Plugin Vulnerabilities

Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal

Description

The plugin does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

Proof of Concept

Affects Plugins

Plugin icon
easy-file-uploader
Fixed in 1.1.10

References

CVE
CVE-2026-124822

Classification

Type
FILE DELETION
OWASP top 10
A6: Security Misconfiguration
CWE
CWE-73
CVSS
10.0 (critical)

Miscellaneous

Original Researcher
Quantum
Submitter
Quantum
Verified
Yes
WPVDB ID
2c3537df-1312-442a-816d-904285c0e9c1

Timeline

Publicly Published
2026-11-11 (about 2 days ago)
Added
2026-11-11 (about 1 day ago)
Last Updated
2026-11-12 (about 7 hours ago)

Other

Published
Title
Published
2025-02-28
Title
Simple Download Counter < 2.1 - Authenticated (Author+) Arbitrary File Read
Published
2025-09-30
Title
FormGent < 1.0.4 - Unauthenticated Arbitrary File Deletion
Published
2020-10-07
Title
HyperComments <= 1.2.2 - Unauthenticated Arbitrary File Deletion
Published
2026-06-30
Title
WP-BusinessDirectory < 4.0.2 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter
Published
2026-11-05
Title
Directorist < 8.11 - Subscriber+ Arbitrary Media Deletion via Listing Image Field