CVE-2026-7311: TinyPNG WordPress Plugin Arbitrary File Deletion Vulnerability (CVSS 8.1)

Technical summary

CVE-2026-7311 is a path traversal vulnerability (CWE-22) in the TinyPNG WordPress plugin's delete_converted_image_size function. The flaw stems from insufficient validation of the 'convert.path' field stored in post meta for attachments. When an attachment is deleted, the vulnerable function processes this path without proper sanitization, enabling an authenticated attacker to inject arbitrary file paths. By crafting a malicious path in the 'tiny_compress_images' post meta on an attachment they own, an attacker can trigger deletion of arbitrary files on the server. The CVSS v3.1 score of 8.1 (HIGH) reflects the high integrity and availability impact, requiring only low attack complexity and low privileges to exploit.

Business impact

Compromise of WordPress installations running the TinyPNG plugin exposes organizations to critical operational and security risks. An attacker with author-level access can delete essential configuration or core files, causing immediate service disruption or enabling remote code execution. Deletion of wp-config.php or similar files can render the site inoperable while simultaneously allowing the attacker to upload malicious code or establish persistent backdoors. For organizations relying on WordPress for customer-facing services, content delivery, or business logic, this can result in downtime, data loss, and reputational damage. Compromise can cascade to underlying infrastructure if the WordPress environment has elevated privileges.

Affected systems

The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is affected in all versions up to and including 3.6.13. Any WordPress installation running this plugin with users holding author-level permissions or higher is at risk. This includes sites where content creators, contributors with elevated roles, or administrators have access. The plugin's ubiquity in WordPress environments—particularly on media-heavy sites—suggests broad exposure across diverse organizations and use cases.

Exploitability

Exploitation requires authentication and author-level or higher privileges, which moderately raises the barrier compared to unauthenticated attacks. However, many WordPress sites grant author-level access to multiple users (content creators, editors, external contributors), reducing the practical difficulty. The attack requires no user interaction, no special network conditions, and the vulnerable code path is trivial to trigger by simply deleting an attachment. The attacker need only craft a single malicious post meta entry on an attachment they control. This combination makes the vulnerability highly exploitable within the context of a compromised or malicious authenticated user.

Remediation

Organizations must immediately update the TinyPNG plugin to a patched version addressing this vulnerability. Verify the specific version number in the vendor advisory before deploying. Until patched, restrict author-level and above permissions to trusted users only, audit existing user roles, and consider disabling the plugin if it is not actively required. Monitor file deletion logs and unexpected changes to wp-config.php and other critical files. Implement file integrity monitoring to detect unauthorized modifications or deletions.

Patch guidance

Apply the latest security update from the TinyPNG plugin developers as soon as it becomes available. Verify the patch version against the official WordPress plugin repository or vendor security advisory. Test the update in a staging environment before rolling out to production to ensure compatibility with your WordPress configuration and any dependent functionality. Review the changelog to confirm the path validation vulnerability has been addressed. After patching, audit any attachments that may have been modified by untrusted users to ensure no backdoors or configurations remain.

Detection guidance

Monitor for suspicious file deletion events, particularly of critical WordPress files such as wp-config.php, .htaccess, or plugin files. Log attachment deletion activities and correlate them with post meta modifications to the 'tiny_compress_images' field containing file paths outside the expected wp-content/uploads directory. Implement file integrity monitoring on wp-config.php and other sensitive configuration files. Review access logs for author-level users performing attachment operations followed by file system anomalies. Web application firewalls can be configured to flag attachment deletion requests that include suspicious path traversal patterns in post meta fields.

Why prioritize this

This vulnerability merits immediate remediation priority due to its HIGH severity rating, the ease of exploitation by authenticated users, and the potential for rapid escalation to remote code execution. The combination of path traversal, arbitrary file deletion, and the prevalence of the plugin across WordPress deployments creates significant organizational risk. Unlike many WordPress vulnerabilities requiring multiple attack steps, this flaw provides a direct path to critical impact with minimal prerequisites. Any organization running this plugin should treat patching as urgent.

Risk score, explained

The CVSS v3.1 score of 8.1 reflects a HIGH-severity vulnerability with network-accessible attack vector, low attack complexity, low privilege requirements, and no user interaction needed. The primary driver is the high impact to integrity (file deletion) and availability (service disruption or system compromise). Although confidentiality impact is not directly affected, the ability to delete wp-config.php enables rapid escalation to remote code execution, which would compromise confidentiality as well. The 'no user interaction' requirement emphasizes the automated nature of the attack once a malicious attachment is staged.

Frequently asked questions