CVE-2026-11367

Name of the Vulnerable Software and Affected Versions PixMagix – WordPress Image Editor versions prior to 1.7.3

Description Authenticated attackers with author-level access and above can write files with controlled content to arbitrary server locations. The issue occurs because the layers[].id parameter is not sanitized before being concatenated into a filesystem path and passed to the copy() function within the move image on server() function. This allows the use of traversal sequences to escape the intended upload directory. The attack is possible via the save template API endpoint, which is accessible to users with the create projects permission.

Recommendations Update PixMagix – WordPress Image Editor to version 1.7.3 or later. As a temporary mitigation, restrict access to the save template API endpoint or limit user permissions to prevent Author-level users from utilizing the create projects permission.