Deserialization Vulnerability in ImageMagick Engine Plugin for WordPress

CVE-2022-3568

Summary

The ImageMagick Engine plugin for WordPress is vulnerable to an exploit involving the deserialization of untrusted input through the 'cli_path' parameter in versions up to and including 1.7.5. This vulnerability allows unauthenticated users to execute arbitrary PHP objects by tricking a site administrator into performing a malicious action, such as clicking on a crafted link. If successful, an attacker may upload a file containing a serialized payload, potentially leading to various harmful outcomes if a suitable object injection gadget (POP chain) is present.

References