Executive brief
The TinyPNG plugin for WordPress, which is used to optimize and compress website images, contains a security flaw that allows certain users to delete files from the web server. An attacker with Author-level permissions or higher can exploit this to remove critical system files, such as configuration files. This can lead to a complete site shutdown or allow the attacker to take full control of the website.
Technical details
The TinyPNG WordPress plugin (versions up to 3.6.13) is vulnerable to arbitrary file deletion due to insufficient path validation in the 'delete_converted_image_size' function. An authenticated attacker with Author-level privileges or higher can exploit this by injecting a malicious file path into the 'convert.path' field of the 'tiny_compress_images' post meta for an attachment they own. When the attacker subsequently deletes that attachment, the plugin attempts to delete the file at the specified path. This can be leveraged to delete critical files like 'wp-config.php', potentially leading to remote code execution or site takeover. A patch has been released in version 3.6.14.
Affected products
- TinyPNG TinyPNG – JPEG, PNG & WebP image compression up to, and including, 3.6.13
Timeline
- 2026-07-02: disclosed
- 2026-07-02: advisory
References
- https://plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-image-size.php
- https://plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-image.php
- https://plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-plugin.php
- https://plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/config/class-tiny-config.php
- https://plugins.trac.wordpress.org/changeset/3532827/tiny-compress-images
- https://www.wordfence.com/threat-intel/vulnerabilities/id/eb8a673e-a192-41d4-b53b-7d786887242d?source=cve