EUVD-2026-40253
GHSA-pmh9-5c73-wc86
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
File-write primitive yields I:H and C:N; PR:L reflects mandatory Author-level authentication; provided vector's C:H/I:N assignment is inconsistent with the described write-only behavior.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The PixMagix - WordPress Image Editor plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.2 via the move_image_on_server function. This makes it possible for authenticated attackers, with author-level access and above, to write files with attacker-controlled content to arbitrary locations on the server. The unsanitized 'layers[].id' parameter is concatenated into a filesystem path and passed to PHP's copy() function, allowing traversal sequences (e.g. '../../') to escape the intended upload directory and write attacker-supplied file contents to arbitrary paths accessible by the web server process. The save_template REST endpoint is gated by the create_projects permission (edit_pixmagix + upload_files), which Author-level users hold by default after plugin activation, making this exploitable by any Author on sites running PixMagix.
AnalysisAI
Arbitrary file write via directory traversal in the PixMagix WordPress Image Editor plugin (all versions through 1.7.2) allows any authenticated Author-level WordPress user to write attacker-controlled content to arbitrary filesystem paths accessible by the web server process. The vulnerability stems from unsanitized use of the layers[].id parameter inside the move_image_on_server function, which concatenates user input directly into a PHP copy() call without path validation. Because the save_template REST endpoint requires only the create_projects permission - automatically granted to Author-level users on plugin activation - any contributor-tier account can exploit this to plant PHP webshells and escalate to remote code execution. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Technical ContextAI
PixMagix is a WordPress image editing plugin developed by andrasweb (CPE: cpe:2.3:a:andrasweb:pixmagix_-_wordpress_image_editor:*:*:*:*:*:*:*:*). The vulnerable code path begins in the save_template REST API callback (rest-callback-save-template.php, lines 91 and 103), which calls move_image_on_server in includes/utils.php (line 465). The function takes the layers[].id parameter from the REST request body and concatenates it into a target filesystem path without sanitization or canonicalization, passing the result to PHP's native copy() function. CWE-22 (Path Traversal) describes this exact class of flaw: user-supplied input containing ../ sequences escapes the intended upload directory boundary. Because the file content is also attacker-supplied, this is not merely a read traversal but a full write-with-content primitive - functionally equivalent to arbitrary file upload once traversal is achieved.
RemediationAI
The primary remediation is to update PixMagix to a version above 1.7.2; however, no patched release version has been independently confirmed in the available data - the fix status should be verified directly in the WordPress plugin repository or via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c87adbd9-3b09-403e-921a-31b3f58962e9. If no patched version is yet available, the most effective compensating control is to deactivate or uninstall the PixMagix plugin entirely until a fix is released, which eliminates the attack surface with no trade-offs. If deactivation is operationally impossible, restrict the WordPress Author role: remove the upload_files capability from Author-level users via a role management plugin, which revokes the create_projects permission and gates access to the vulnerable REST endpoint - note this will break media upload functionality for Authors. Additionally, configure the web server process to run with minimal filesystem permissions so that even if traversal succeeds, writes outside the upload directory are blocked by OS-level access controls.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today