CVE-2026-7311

🗓️ 02 Jul 2026 18:32:13Reported by WordfenceType

CVE-2026-7311: TinyPNG lets authenticated users delete arbitrary files via convert.path post meta up to 3.6.13.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-7311	2 Jul 202618:32	–	attackerkb
Circl	CVE-2026-7311	2 Jul 202620:16	–	circl
Cvelist	CVE-2026-7311 TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta	2 Jul 202618:32	–	cvelist
EUVD	EUVD-2026-41418	2 Jul 202618:32	–	euvd
NVD	CVE-2026-7311	2 Jul 202619:17	–	nvd
Positive Technologies	PT-2026-55284	2 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-7311 TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta	2 Jul 202618:32	–	vulnrichment

Vulners

Node

tinypng tinypng_jpeg,_png_&_webp_image_compressionRange≤3.6.13wordpress

[
  {
    "vendor": "tinypng",
    "product": "TinyPNG – JPEG, PNG & WebP image compression",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "3.6.13",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3532827/tiny-compress-images
plugins	www.plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-plugin.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/eb8a673e-a192-41d4-b53b-7d786887242d
plugins	www.plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/config/class-tiny-config.php
plugins	www.plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-image-size.php
plugins	www.plugins.trac.wordpress.org/browser/tiny-compress-images/tags/3.6.13/src/class-tiny-image.php

02 Jul 2026 20:17Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.18.1

SSVC

CWE-22