Arbitrary File Deletion Vulnerability in TinyPNG Plugin for WordPress

CVE-2026-7311

What is CVE-2026-7311?

The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is susceptible to arbitrary file deletion due to a lack of stringent file path validation within the delete_converted_image_size function. This vulnerability impacts all versions up to and including 3.6.13. Authenticated users with author-level access or higher can exploit this weakness to delete arbitrary files on the server, potentially paving the way for remote code execution. The attack is initiated by injecting a malicious file path into the 'convert.path' field of the 'tiny_compress_images' post meta associated with an attachment they control, subsequently triggering the deletion process, and thereby exposing the server to significant risks.

References