Directory Traversal Vulnerability in PixMagix – WordPress Image Editor Plugin

CVE-2026-11367

What is CVE-2026-11367?

The PixMagix – WordPress Image Editor plugin is exposed to directory traversal vulnerabilities that allow authenticated users with author-level privileges to write arbitrary files to any location on the server. This issue arises from the unsafe handling of user input in the move_image_on_server function, which improperly sanitizes file paths. The plugin's save_template API endpoint can potentially allow attackers to utilize traversal sequences to access sensitive areas of the filesystem, leading to severe security risks. All versions up to and including 1.7.2 are affected.

References