CVE-2026-7311

Name of the Vulnerable Software and Affected Versions TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress versions prior to 3.6.14

Description Insufficient file path validation in the delete converted image size() function allows authenticated attackers with author-level access or higher to delete arbitrary files on the server. This can be achieved by injecting a server file path into the convert.path field of the tiny compress images post meta on an attachment owned by the attacker and then triggering the attachment deletion. Deleting critical files, such as wp-config.php, can lead to remote code execution.

Recommendations Update the plugin to version 3.6.14 or later.