TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta
high
The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and including, 3.6.13. This makes it possible for authenticated attackers, with author-level access a...
- CVSS:
- 8.1
- Affected:
- up to 3.6.13
- Fixed in:
- 3.6.14
- Disclosed:
- Jul 2, 2026
CVE-2026-7311 on NVD →
TinyPNG <= 3.4.3 - Cross-Site Request Forgery
medium
The TinyPNG plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.3. This is due to missing or incorrect nonce validation on the update_api_key() function and other functions. This makes it possible for unauthenticated attackers to update settings via a forged request gr...
- CVSS:
- 4.3
- Affected:
- up to 3.4.3
- Fixed in:
- 3.4.4
- Disclosed:
- Sep 30, 2024
CVE-2024-47635 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database