Executive brief
PixMagix is a WordPress plugin used for editing images directly within the website's dashboard. A security flaw allows users with 'Author' permissions or higher to bypass security restrictions and write files to unauthorized locations on the web server. This could allow an attacker to overwrite critical system files or place malicious content in sensitive directories, potentially compromising the integrity of the website.
Technical details
A directory traversal vulnerability exists in the PixMagix plugin due to insufficient sanitization of the 'layers[].id' parameter within the move_image_on_server function. This parameter is concatenated into a filesystem path and subsequently passed to PHP's copy() function. An authenticated attacker with Author-level permissions (specifically the 'edit_pixmagix' and 'upload_files' capabilities) can use traversal sequences like '../../' to escape the intended upload directory. This allows the attacker to write arbitrary file content to any path accessible by the web server process. The vulnerability is reachable via the save_template REST endpoint.
Affected products
- andrasweb PixMagix – WordPress Image Editor up to, and including, 1.7.2
Timeline
- 2026-06-30: advisory: NVD publication date
- 2026-06-30: disclosed: Wordfence disclosure date
References
- https://plugins.trac.wordpress.org/browser/pixmagix/tags/1.7.2/includes/rest-api/rest-callback-save-template.php
- https://plugins.trac.wordpress.org/browser/pixmagix/tags/1.7.2/includes/rest-api/rest-callback-save-template.php
- https://plugins.trac.wordpress.org/browser/pixmagix/tags/1.7.2/includes/utils.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c87adbd9-3b09-403e-921a-31b3f58962e9?source=cve