Vulnerability Lookup

🛡️ CVE-2022-2441

🟠 CVSS 8.8 — High ⚠️ Exploit Public CWE-352 NVD

8.8

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.

Details

Severity HIGH

CVSS Score 8.8

CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE CWE-352

Public Exploit ⚠️ Yes

Source NVD

Published 2023-10-20

Updated 2026-06-08

Modified 2026-04-08

Fix URL https://github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php#L529

Affected Packages

Software	From version	Fixed in
imagemagick-engine	—	1.7.5

References

Patch https://github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php#L529

Patch https://github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php#L529

Patch https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2801283%40imagemagick-engine%2Ftrunk&old=2732430%40imagemagick-engine%2Ftrunk&sfp_email=&sfph_mail=

Exploit, Third Party Advisory, VDB Entry https://www.exploit-db.com/exploits/51025

Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f17a83-1df0-44fe-bd86-243cff6ec91b?source=cve

Third Party Advisory https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-2441

Patch https://github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php#L529

Patch https://github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php#L529

Patch https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2801283%40imagemagick-engine%2Ftrunk&old=2732430%40imagemagick-engine%2Ftrunk&sfp_email=&sfph_mail=

Exploit, Third Party Advisory, VDB Entry https://www.exploit-db.com/exploits/51025

Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f17a83-1df0-44fe-bd86-243cff6ec91b?source=cve

Third Party Advisory https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-2441

🔗 NVD 🔗 Mitre ✅ Fix / Advisory

Similar Threats

High CVE-2024-6486
High CVE-2022-2441

Exploit Protection

Help block exploit attempts

BotEraser is designed to detect and help reduce malicious bot traffic that may target known vulnerabilities on your site.

Try BotEraser Free →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.

Help block exploit attempts

Company

Resources

Services

Trusted

Subscribe