PNG to JPG <= 4.5 - Authenticated (Author+) Missing Authorization to Arbitrary PNG Attachment Conversion
- ID
- WPSEC-2026-1758
- Plugin
- PNG to JPG (png-to-jpg)
- Affected
- all versions before 4.6
- Remediation
- Update to 4.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-27
- Attack surface
- PNG to JPG on WPSec AttackSurface
- Fix released
- Published
Description
The PNG to JPG plugin for WordPress is vulnerable to unauthorized modification of data via the media library 'Convert to JPG' action in all versions up to, and including, 4.5, due to a missing capability check in the convert_png_from_media_library() function and a nonce that was not tied to a specific attachment. The function runs on the wp_loaded hook. This makes it possible for authenticated attackers, with Author-level access and above, to convert any PNG attachment on the site to JPG, including attachments that belong to other users. The conversion can delete the original PNG and its thumbnails, and it rewrites the image URLs across the site's database.
References
- https://wpsec.com/vuln/WPSEC-2026-1758/
- https://plugins.svn.wordpress.org/png-to-jpg/tags/4.6/
- https://wordpress.org/plugins/png-to-jpg/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS