EUVD-2026-41418
GHSA-p2fp-6329-h7jp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Author-level account is required so PR:L; the media/post-meta path is network-reachable and reliable (AV:N, AC:L, UI:N); arbitrary deletion yields I:H/A:H with no direct data disclosure (C:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The TinyPNG - JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and including, 3.6.13. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can exploit this by injecting an arbitrary server file path into the 'convert.path' field of the 'tiny_compress_images' post meta on an attachment they own, then triggering attachment deletion to invoke the vulnerable code path.
AnalysisAI
Arbitrary file deletion in the TinyPNG (JPEG, PNG & WebP image compression) plugin for WordPress affects all versions through 3.6.13, allowing authenticated attackers with author-level access or higher to delete any file the web server can reach. Because deleting sensitive files such as wp-config.php pushes the site into a fresh-install state, this file-deletion primitive can be escalated to full remote code execution. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but it was disclosed by Wordfence with a clear exploitation path and carries a CVSS 8.1 (High).
Technical ContextAI
The plugin (WordPress slug tiny-compress-images) integrates the TinyPNG/TinyJPG compression API into the WordPress media library, storing per-attachment conversion metadata in the 'tiny_compress_images' post meta. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the delete_converted_image_size function in class-tiny-image-size.php (around line 245) uses an attacker-controllable 'convert.path' value from that post meta without validating that the path stays within the intended uploads directory. When an attachment is deleted, the plugin walks its stored size metadata (class-tiny-image.php:144, class-tiny-plugin.php:859) and unlinks the referenced path, so a poisoned path is dereferenced directly against the filesystem with the privileges of the PHP/web-server user.
RemediationAI
Upstream fix available (changeset/commit); a released patched version is not independently confirmed from the provided data - the corrective code is in WordPress.org plugin changeset 3532827 (https://plugins.trac.wordpress.org/changeset/3532827/tiny-compress-images), so update the tiny-compress-images plugin to the first release built from that changeset (the next version after 3.6.13) as soon as it is available and confirmed by the vendor. Until you can verify the patched version, apply compensating controls: restrict who holds author-or-above roles and audit existing author/editor accounts, since exploitation requires that privilege level; if the plugin is not actively needed, deactivate and remove it to eliminate the code path entirely (trade-off: image compression stops); consider tightening filesystem permissions so the PHP/web-server user cannot delete wp-config.php or files outside wp-content/uploads (trade-off: may break other plugins that write outside uploads); and add a web application firewall rule to monitor or block manipulation of the 'tiny_compress_images' post meta and 'convert.path' field (Wordfence customers may receive a signature). Verify remediation against the Wordfence advisory URL above.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today