Imagemagick Engine
Approved changes feed: RSS · Atom
cpe:2.3:a:orangelab:imagemagick_engine:*:*:*:*:*:wordpress:*:*part: a version: * update: *
| Vendor | Orangelab (bc449d50-c763-589a-9d77-7ae6b9173fc1) |
|---|---|
| Product | Imagemagick Engine (8fe7b174-5b02-5d25-9eed-9495bb6e9535) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/orangelabweb/imagemagick-engine |
purl2cpe | 2026-06-01 10:12:02.042917 |
pkg:github/wpplugins/imagemagick-engine |
purl2cpe | 2026-06-01 10:12:02.042919 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-6486 |
vulnerable | 2026-06-08 06:58:19.575089 |
ImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection
The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.
Published: 2025-05-15T20:07:07.616Z
Updated: 2025-05-20T19:24:28.330Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3568 |
vulnerable | 2026-06-08 05:48:21.444042 |
ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization
HIGH (8.8)
The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Published: 2023-02-09T23:34:58.206Z
Updated: 2026-04-08T16:50:39.828Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-2441 |
vulnerable | 2026-06-08 05:43:35.556989 |
ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Execution
HIGH (8.8)
The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.
Published: 2023-10-20T07:29:28.362Z
Updated: 2026-04-08T17:16:21.839Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.