CVE-2026-124822 - Critical Vulnerability in Easy DragDrop File Uploader for WordPress

Introduction

The CVE-2026-124822 vulnerability affects the Easy DragDrop File Uploader plugin for WordPress, allowing unauthenticated users to delete arbitrary files on the server.

What happened?

The plugin, in versions prior to 1.1.10, does not properly validate user-supplied paths before deleting files. This lack of validation allows an attacker to delete critical files, such as wp-config.php, compromising the security of the site.

How the vulnerability works

The vulnerability arises from the lack of input validation in the plugin. When a user provides a path to a file to be deleted, the plugin does not check whether that path is safe or if the user has permission to perform that action. As a result, any user can send a request to delete arbitrary files on the server.

What is the real impact?

The impact of this vulnerability is critical, as it allows an unauthenticated attacker to delete essential files from the system, potentially leading to data loss and service disruption. Deleting wp-config.php can result in the site being unable to function properly, further exposing the system to attacks.

Which versions are affected?

• Easy DragDrop File Uploader before version 1.1.10

How to fix

1. Update the Easy DragDrop File Uploader plugin to version 1.1.10 or higher.
2. Verify that the update has been applied correctly and that the plugin is functioning as expected.
3. Monitor server logs for any suspicious activity related to file deletions.

Mitigation while you update

While an update is not possible, it is recommended to deactivate the Easy DragDrop File Uploader plugin to prevent any exploitation of the vulnerability.

Conclusion

The CVE-2026-124822 vulnerability is a critical flaw that must be addressed urgently. Updating the plugin is the best way to ensure the security of your WordPress site.