# PNG to JPG <= 4.5 - Authenticated (Author+) Missing Authorization to Arbitrary PNG Attachment Conversion

- **ID:** WPSEC-2026-1758
- **Plugin:** PNG to JPG (`png-to-jpg`), https://wordpress.org/plugins/png-to-jpg/
- **Affected versions:** all versions before 4.6
- **Fixed in:** 4.6 (Update to 4.6 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/png-to-jpg
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1758/

## Description

The PNG to JPG plugin for WordPress is vulnerable to unauthorized modification of data via the media library 'Convert to JPG' action in all versions up to, and including, 4.5, due to a missing capability check in the convert_png_from_media_library() function and a nonce that was not tied to a specific attachment. The function runs on the wp_loaded hook. This makes it possible for authenticated attackers, with Author-level access and above, to convert any PNG attachment on the site to JPG, including attachments that belong to other users. The conversion can delete the original PNG and its thumbnails, and it rewrites the image URLs across the site's database.

## References

- https://wpsec.com/vuln/WPSEC-2026-1758/
- https://plugins.svn.wordpress.org/png-to-jpg/tags/4.6/
- https://wordpress.org/plugins/png-to-jpg/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1758/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.