PT-2026-55284 · WordPress · Tinypng

Lhking · Published 2026-07-02 · Updated 2026-07-02 · CVE-2026-7311

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress versions prior to 3.6.14

Description Insufficient file path validation in the delete converted image size() function allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. This can be achieved by injecting a server file path into the convert.path field of the tiny compress images post meta on an attachment owned by the attacker and then triggering the attachment deletion. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update the plugin to version 3.6.14 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-7311

Affected Products

Tinypng

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-7311 · Security Note
• https://plugins.trac.wordpress.org/changeset/3532827/tiny-compress-images · Note
• https://plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/config/class-tiny-config.php#L12 · Note
• https://twitter.com/CVEnew/status/2072756729436062036 · Twitter Post
• https://plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-image.php#L144 · Note
• https://twitter.com/infoflowcloud/status/2072757437707297024 · Twitter Post
• https://plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-image-size.php#L245 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/eb8a673e-a192-41d4-b53b-7d786887242d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-plugin.php#L859 · Note