WordPress CVEs

Description

The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.

Affected WordPress components

• ImageMagick Engine Plugin · imagemagick-engine
  Possible match Active
  Up to and including 1.7.5
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• rickardw ImageMagick Engine — Up to and including 1.7.5
• orangelab imagemagick_engine — Up to and including 1.7.5

References

• github.com https://github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php#L529 Patch
• github.com https://github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php#L529 Patch
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2801283%40imagemagick-engine%2Ftrunk&old=2732430%40imagemagick-engine%2Ftrunk&sfp_email=&sfph_mail= Patch
• www.exploit-db.com https://www.exploit-db.com/exploits/51025 Exploit, Third Party Advisory, VDB Entry
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f17a83-1df0-44fe-bd86-243cff6ec91b?source=cve Third Party Advisory
• www.wordfence.com https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-2441 Third Party Advisory
• nvd.nist.gov Official NVD record