The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress contains a path traversal flaw in the delete_converted_image_size function. Because the plugin does not properly validate the file path supplied in the 'convert.path' field of the 'tiny_compress_images' post meta, an actor that has author‑level or higher access can inject an arbitrary server file path. When that attachment is deleted, the vulnerable code path triggers deletion of the specified file, allowing attackers to remove critical site files such as wp-config.php and potentially execute code located in or after the deletion operation. The weakness is identified as a classic path‑traversal vulnerability (CWE‑22).

All WordPress sites that use the TinyPNG plugin, version 3.6.13 or earlier, are affected. Users with author‑level or higher roles can exploit the flaw. The issue is independent of the WordPress core version and exposes any file that the plugin’s delete operation can reach via the supplied file path.

The CVSS v3.1 score of 8.1 indicates high severity, while the EPSS score of less than 1% points to a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, so no active exploit activity is recorded. Exploitation requires authenticated access to an attachment’s post meta, injection of a file path into the 'convert.path' field, and triggering of the attachment’s deletion. If an attacker deletes a pivotal file such as wp-config.php, remote code execution and full site compromise can ensue.