{
 "id": "WPSEC-2026-1758",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1758/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1758/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1758/index.md",
 "title": "PNG to JPG <= 4.5 - Authenticated (Author+) Missing Authorization to Arbitrary PNG Attachment Conversion",
 "description": "The PNG to JPG plugin for WordPress is vulnerable to unauthorized modification of data via the media library 'Convert to JPG' action in all versions up to, and including, 4.5, due to a missing capability check in the convert_png_from_media_library() function and a nonce that was not tied to a specific attachment. The function runs on the wp_loaded hook. This makes it possible for authenticated attackers, with Author-level access and above, to convert any PNG attachment on the site to JPG, including attachments that belong to other users. The conversion can delete the original PNG and its thumbnails, and it rewrites the image URLs across the site's database.",
 "plugin": {
  "slug": "png-to-jpg",
  "name": "PNG to JPG",
  "full_name": "PNG to JPG",
  "wordpress_org": "https://wordpress.org/plugins/png-to-jpg/",
  "advisories_url": "https://wpsec.com/vuln/plugin/png-to-jpg/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/png-to-jpg"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.6",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.6"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.6",
 "remediation": "Update to 4.6 or later.",
 "fix_released": "2026-10-26T13:58:02+00:00",
 "published": "2026-10-27T14:45:37+00:00",
 "updated": "2026-10-27T13:05:26.308123+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1758/",
  "https://plugins.svn.wordpress.org/png-to-jpg/tags/4.6/",
  "https://wordpress.org/plugins/png-to-jpg/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/png-to-jpg",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-27"
 }
}