CVE-2026-124822

Not scored yetLast modified Nov 13, 2026

Description

The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 13, 2026
Last modified
Nov 13, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-124837.5The LearnDash LMS plugin for WordPress is vulnerable to Unrestricted File Type Upload in versions up to and including 5.1.5. This is due to CVE-2026-124833The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them tCVE-2026-1248343.7A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_CVE-2026-124847.8A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the publCVE-2026-1248485.5Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Linux might allow other CVE-2026-1248510.0GV-I/O Box 4E is a smart embedded device with 4 input and 4 relays output that can be controlled over Ethernet and RS-485. DVRSearch is a sCVE-2026-1248507.3A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier vCVE-2026-1248528.8Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.CVE-2026-1248539.6Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESCVE-2026-124854Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and CVE-2026-124855Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and ThundeCVE-2026-1248568.8Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird
CVE-2026-124822: Unscored | Vulnix