CVE-2026-11367: PixMagix Path Traversal Vulnerability

CVE-2026-11367 Overview

CVE-2026-11367 is a directory traversal vulnerability in the PixMagix – WordPress Image Editor plugin, affecting all versions up to and including 1.7.2. The flaw resides in the move_image_on_server function, invoked by the save_template REST endpoint. Authenticated users with Author-level access or higher can write attacker-controlled file contents to arbitrary paths on the web server. The vulnerability is classified as [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Authenticated Author-level users can write arbitrary files anywhere accessible to the web server process, enabling potential webshell placement and remote code execution on WordPress sites running PixMagix.

Affected Products

PixMagix – WordPress Image Editor plugin, all versions through 1.7.2
WordPress sites where Author-level (or higher) accounts exist
WordPress installations with the plugin activated and default create_projects capability mapping

Discovery Timeline

2026-06-30 - CVE-2026-11367 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-11367

Vulnerability Analysis

The PixMagix plugin exposes a REST route that handles template saves through rest-callback-save-template.php. Within that handler, the move_image_on_server helper builds a destination filesystem path by concatenating the layers[].id value supplied in the request body. The plugin does not sanitize or validate this identifier against traversal sequences before passing it to PHP's copy() function. Attackers can inject ../../ sequences into the id field to escape the intended uploads directory. The copy() call then writes attacker-supplied content to any location writable by the PHP process.

Root Cause

The root cause is missing input validation on the layers[].id parameter used to construct filesystem paths. The plugin trusts client-supplied identifiers as safe path components, violating the principle of treating all request input as untrusted. There is no allow-list check, no basename() normalization, and no verification that the resolved path stays within the intended upload directory.

Attack Vector

Exploitation requires an authenticated account holding the create_projects capability, which combines edit_pixmagix and upload_files. After plugin activation, WordPress Author-level users hold this capability by default. An attacker with Author credentials sends a crafted POST request to the save_template REST endpoint. The request payload contains a layers array where each object's id field embeds traversal sequences followed by a target filename such as shell.php. Because the resulting file contents are attacker-controlled, the attacker can drop a PHP file into a web-accessible directory and achieve code execution. Full technical details, including the vulnerable line numbers, are available in the WordPress PixMagix source at rest-callback-save-template.php#L103 and the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-11367

Indicators of Compromise

POST requests to the WordPress REST route /wp-json/pixmagix/v1/save-template containing ../ sequences inside layers[].id values.
New or modified .php files in WordPress directories such as wp-content/uploads/, wp-content/plugins/, or the site root with recent timestamps that do not correspond to legitimate plugin or theme updates.
Author-level accounts issuing template-save API calls immediately after login, particularly from IP addresses without prior editorial history.
Web server processes (www-data, apache, php-fpm) writing files outside the standard uploads structure.

Detection Strategies

Inspect WordPress access logs for requests to pixmagix REST routes and parse JSON bodies for traversal patterns in the id field.
Deploy file integrity monitoring across the WordPress document root to alert on new executable file types written by the PHP process.
Alert when Author-level accounts perform actions that result in filesystem writes outside wp-content/uploads/pixmagix/.
Correlate authentication events with subsequent REST API calls to identify credential abuse against low-privileged accounts.

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward logs to a central SIEM for pattern matching on traversal sequences.
Track EPSS movement for CVE-2026-11367 (currently 0.541%) to prioritize response as exploitation likelihood shifts.
Monitor outbound connections from the web server to detect callback traffic from any dropped webshells.
Review the WordPress wp_users and wp_usermeta tables for unexpected role escalations or newly created Author accounts.

How to Mitigate CVE-2026-11367

Immediate Actions Required

Deactivate the PixMagix plugin on any site running version 1.7.2 or earlier until a patched release is installed.
Audit all Author-level and higher accounts, remove unused users, and enforce strong password requirements plus multi-factor authentication.
Scan wp-content/uploads/ and the WordPress root for unexpected .php, .phtml, or .phar files and remove any that are not part of a legitimate install.
Restrict PHP execution in the uploads directory using web server configuration to blunt the impact of any successful file write.

Patch Information

At the time of NVD publication on 2026-06-30, all PixMagix versions up to and including 1.7.2 are affected. Consult the Wordfence Vulnerability Analysis and the plugin repository for the latest fixed release, then update through the WordPress admin dashboard or via WP-CLI.

Workarounds

Remove the upload_files or edit_pixmagix capability from the Author role using a role management plugin to break the create_projects requirement.
Block requests to /wp-json/pixmagix/* at the web application firewall for any body containing .. sequences in JSON id fields.
Set the web server user to read-only on all directories except a narrowly scoped uploads path.
Temporarily limit REST API access to authenticated administrators only, if template-editing functionality is not business-critical.

bash

# Example WP-CLI capability removal for the Author role
wp cap remove author edit_pixmagix
wp cap remove author upload_files

# Example Apache rule to deny PHP execution inside uploads
# Place in wp-content/uploads/.htaccess
<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>