CVE-2026-124822

Easy DragDrop File Uploader arbitrary file deletion via path traversal in uploader

critical · 10.0

Fix listed

Easy DragDrop File Uploader

Published Nov 13, 2026, 06:00 UTC

Description

The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

Reported fixed versions

1.1.10

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.