CVE-2026-124822
Easy DragDrop File Uploader
Published 13 Nov 2026 · updated 13 Nov 2026 · Deferred
10.0 Critical · CVSS 3.1, CISA ADP
Description
The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.