{"id":"CVE-2026-124822","kind":"vulnerability","aliases":["CVE-2026-124822"],"related":[],"title":"WordPress Easy DragDrop File Uploader: unauthenticated arbitrary file deletion on server","description":"The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.","summary":"The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it. An unauthenticated visitor can delete arbitrary files and directories on the server, including wp-config.php.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Easy DragDrop File Uploader folder.\n- Confirm whether the installed version is below `1.1.10`.","fix":"- Easy DragDrop File Uploader (WordPress plugin): `1.1.10` or later","status":"open","published_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","triaged_at":"2026-11-13T06:42:26+00:00","updated_at":"2026-11-13T06:42:26+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T06:42:26Z","model":"claude-haiku-5-5","output":{"fix":"- Easy DragDrop File Uploader (WordPress plugin): `1.1.10` or later","reach":"internet","title":"WordPress Easy DragDrop File Uploader: unauthenticated arbitrary file deletion on server","impact":"high","summary":"The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it. An unauthenticated visitor can delete arbitrary files and directories on the server, including wp-config.php.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker deletes wp-config.php and takes over the site","analyst_note":"Product ranges and exploit details are not in the signal; verify the affected plugin and version range against the NVD entry.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/` for the Easy DragDrop File Uploader folder.\n- Confirm whether the installed version is below `1.1.10`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Easy DragDrop File Uploader WordPress plugin before version 1.1.10 are exposed, because the flaw is reachable without logging in. Sites that do not have this plugin installed are not affected. The sources do not say whether a default configuration is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000736,"input_tokens":4531,"output_tokens":566,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124822':14A,17A '-2026':13A,16A '1.1.10':31B,65C 'allow':77C 'arbitrari':7A,48B,82C 'cve':12A,15A 'delet':9A,41B,47B,75C,81C 'directori':51B,85C 'dragdrop':3A,25B,59C 'easi':2A,24B,58C 'file':4A,8A,26B,49B,60C,83C 'host':21B 'includ':55B 'packag':18B 'path':39B,73C 'plugin':29B,63C 'self':20B 'self-host':19B 'server':11A,54B,88C 'suppli':38B,72C 'unauthent':6A,44B,78C 'upload':5A,27B,61C 'user':37B,71C,79C 'user-suppli':36B,70C 'valid':34B,68C 'visitor':45B 'wordpress':1A,22B,28B,62C 'wp-config.php':56B,91C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Easy DragDrop File Uploader WordPress plugin before version 1.1.10 are exposed, because the flaw is reachable without logging in. Sites that do not have this plugin installed are not affected. The sources do not say whether a default configuration is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-124822':14A,17A '-2026':13A,16A 'arbitrari':7A 'cve':12A,15A 'delet':9A 'dragdrop':3A 'easi':2A 'file':4A,8A 'server':11A 'unauthent':6A 'upload':5A 'wordpress':1A","search_b":"'1.1.10':31B 'arbitrari':48B 'delet':41B,47B 'directori':51B 'dragdrop':25B 'easi':24B 'file':26B,49B 'host':21B 'includ':55B 'packag':18B 'path':39B 'plugin':29B 'self':20B 'self-host':19B 'server':54B 'suppli':38B 'unauthent':44B 'upload':27B 'user':37B 'user-suppli':36B 'valid':34B 'visitor':45B 'wordpress':22B,28B 'wp-config.php':56B","search_c":"'1.1.10':65C 'allow':77C 'arbitrari':82C 'delet':75C,81C 'directori':85C 'dragdrop':59C 'easi':58C 'file':60C,83C 'path':73C 'plugin':63C 'server':88C 'suppli':72C 'unauthent':78C 'upload':61C 'user':71C,79C 'user-suppli':70C 'valid':68C 'wordpress':62C 'wp-config.php':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T06:16:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124822","severity":null,"published_at":"2026-11-13T06:16:53+00:00","modified_at":"2026-11-13T06:16:53+00:00","first_seen_at":"2026-11-13T06:42:17+00:00","fetched_at":"2026-11-13T06:42:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}