Vulnerabilities

TI-2024-06016 CVE-2024-6486 · GHSA-j2p9-f4vx-cp2g

ImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection

HIGH 67

The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0235 Published 2025-05-15 Fixed in 1.7.11 CWE-78

TI-2022-02255 CVE-2022-2441 · GHSA-grgw-cqmv-xp2v

ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution

HIGH 73

The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01089 Published 2023-10-20 No fix listed CWE-352

TI-2022-03284 CVE-2022-3568 · GHSA-f3x8-m359-fj94

ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization

MEDIUM 41

The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00626 Published 2023-02-09 No fix listed CWE-502

Vulnerabilities

Filters

ImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection

ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution

ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization