The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress includes a flaw that allows authenticated users with author‑level access or higher to inject a file path into the 'convert.path' field of the 'tiny_compress_images' post meta and trigger the delete_converted enabling the files such as wp‑config.php can give an attacker full control of the site, resulting in remote code execution. The weakness is a classic path‑traversal flaw (CWE‑22). Based on the description, it is inferred that an attacker can exploit this vulnerability by injecting an arbitrary server file path into the 'convert.path' field of an attachment they own and then triggering attachment deletion to invoke the vulnerable code path.

Affected systems: The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress, version 3.6.13 and earlier, is impacted. All WordPress installations that use this plugin and have users with author-level or higher roles can be affected. The flaw exists regardless of the underlying WordPress core version.

With a CVSS score of 8.1, the vulnerability is reported as < 1%, indicating a very low probability of exploitation. It is not listed in the CISA KEV catalog, so no active exploitation is known. Based on the description, it is inferred that an attacker would need author‑level or higher access and control over an attachment they own. By injecting a file path into the 'convert.path' field of that attachment's post meta and triggering deletion, the attacker server. Such a deletion, for example of wp-config.php, could lead to remote code execution and complete site compromise.