CVE-2026-7311 is a path traversal vulnerability (CWE-22) in the TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress. The vulnerability arises from inadequate validation of file paths in the delete_converted_image_size function, allowing authenticated attackers with author-level privileges or higher to delete arbitrary files on the server. The attack vector involves injecting an arbitrary server file path into the 'convert.path' field of the 'tiny_compress_images' post meta associated with an attachment owned by the attacker, then triggering the deletion of that attachment to execute the file deletion. This can lead to remote code execution if sensitive files such as wp-config.php are deleted. The vulnerability affects all versions up to and including 3.6.13. No official patch or remediation level has been published as of the data provided.

An attacker with author-level access or higher can delete arbitrary files on the server by exploiting this vulnerability. This can result in denial of service or remote code execution if critical files like wp-config.php are deleted. The vulnerability does not directly disclose data but can severely impact the integrity and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level access to trusted users only and monitor for suspicious activity related to attachment deletion. Avoid using the affected plugin versions in sensitive environments. Follow vendor updates closely for an official patch or temporary workaround.