Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and including, 3.6.13. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can exploit this by injecting an arbitrary server file path into the 'convert.path' field of the 'tiny_compress_images' post meta on an attachment they own, then triggering attachment deletion to invoke the vulnerable code path.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-7311 The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_co… https://www.cve.org/CVERecord?id=CVE-2026-7311
Post summary
The TinyPNG plugin for WordPress is vulnerable to arbitrary file deletion caused by insufficient file path validation, as documented in its CVE record.
🚨*CVE* CVE-2026-7311 The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_co… https://www.cve.org/CVERecord?id=CVE-2026-7311 ----- Traducción: CVE-2026-7311 El … http://infoflow.cloud`
Post summary
The post announces CVE-2026-7311, describing a vulnerability in TinyPNG that allows arbitrary file deletion via insufficient path validation; it offers no PoC, exploit, patch, or evidence of active exploitation.