CVE-2026-11367: PixMagix Directory Traversal Vulnerability

Technical summary

CVE-2026-11367 is a directory traversal vulnerability in PixMagix versions up to 1.7.2, rooted in the move_image_on_server function. The vulnerability stems from insufficient sanitization of the 'layers[].id' parameter, which is concatenated directly into a filesystem path passed to PHP's copy() function. An authenticated attacker can embed directory traversal sequences into this parameter to write attacker-controlled content to arbitrary server locations. The save_template REST endpoint, which exposes this functionality, is protected by the create_projects permission (requiring edit_pixmagix and upload_files capabilities). Since author-level WordPress users receive these permissions by default upon plugin activation, the attack surface includes all authors on the site. The vulnerability maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Business impact

This vulnerability enables privilege escalation and code execution on WordPress sites. An author-level user can write arbitrary files—including PHP files—to web-accessible directories, potentially leading to remote code execution and complete site compromise. Beyond direct compromise, attackers can overwrite legitimate files, insert malware, modify configurations, or establish persistence mechanisms. For agencies relying on PixMagix for image editing workflows, the risk extends to data exfiltration and defacement. Organizations hosting multiple WordPress sites using this plugin face cascading risk if a single author account is compromised.

Affected systems

All versions of the PixMagix – WordPress Image Editor plugin up to and including version 1.7.2 are vulnerable. Any WordPress installation with PixMagix activated and at least one author-level user (or higher) is at risk. The plugin must be present and active; vulnerability is not exploitable on sites without PixMagix installed. Severity increases in multiauthor environments where multiple author accounts may exist, expanding the potential attack surface.

Exploitability

Exploitation requires valid WordPress authentication with author-level privileges or higher (contributor roles cannot exploit this). No user interaction is needed beyond the attacker having account access. An attacker with author credentials can craft a malicious request to the save_template REST endpoint, injecting directory traversal sequences into the 'layers[].id' parameter to write arbitrary content. The vulnerability is straightforward to exploit—no complex race conditions, timing requirements, or special server configurations are needed. Given the default permissions structure, this is a high-confidence exploitability concern in multiauthor environments.

Remediation

Immediately update PixMagix to a patched version if available. Verify against the vendor's official release notes for the first version addressing CVE-2026-11367. As an interim mitigation, restrict author-level access on WordPress sites running unpatched PixMagix versions. Use WordPress role management or security plugins to limit the create_projects permission (edit_pixmagix and upload_files capabilities) to only trusted administrators. Additionally, implement Web Application Firewall (WAF) rules to detect and block requests containing path traversal sequences in REST API calls to the save_template endpoint. Monitor server file creation and modification events for suspicious activity.

Patch guidance

Contact the PixMagix developers or check the official plugin repository for updates released after June 30, 2026. Apply patches immediately in development environments first, test image editor workflows thoroughly, and roll out to production with a change management process. If the vendor has not released a patch, assess the business need for the plugin against the security risk and consider alternative image editing solutions. Document the patch application date and version for compliance and audit purposes.

Detection guidance

Monitor REST API access logs for requests to the save_template endpoint containing path traversal sequences such as '../', '..\', or encoded variants (%2e%2e%2f). Alert on any POST requests from author-level users (or lower privilege accounts) to this endpoint. Check the filesystem for suspicious files written outside the standard wp-content/uploads directory, particularly PHP files or executables created near the plugin activation date. Review WordPress audit logs for author-level account activity spikes or unusual image manipulation operations. Enable detailed logging on the web server and PHP engine to capture copy() function calls with suspicious paths.

Why prioritize this

Although rated MEDIUM (CVSS 6.5), this vulnerability warrants immediate attention because it grants file write access to arbitrary server locations for any author-level user. The default permission model makes exploitation trivial in typical multiauthor WordPress environments. The combination of low exploitability barriers (authentication only, no user interaction), high impact (arbitrary file write leading to code execution), and broad affected base (all sites running the plugin) elevates practical risk. Organizations should prioritize patching or mitigation above other MEDIUM-severity issues lacking such direct paths to compromise.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a network-accessible, low-complexity attack requiring low privilege (authentication as author) with no user interaction. The scope is unchanged, and the confidentiality impact is marked as HIGH (due to ability to read files via write operations or subsequent exploitation), with no integrity or availability impact in the base vector. The score appropriately captures the authentication requirement but may understate practical risk in organizations where multiple authors have access; security teams should consider elevated priority in multiauthor deployments.

Frequently asked questions