WordPress · Imagemagick Engine · CVE-2022-2441
**Name of the Vulnerable Software and Affected Versions**
ImageMagick Engine plugin for WordPress versions up to, and including 1.7.5
**Description**
The issue allows for remote code execution via the `cli path` parameter. This enables unauthenticated users to run arbitrary commands, potentially leading to remote command execution if a site administrator can be tricked into performing a specific action, such as clicking on a link. As a result, attackers can create or modify files on the server, which may grant them backdoor access to the affected server.
**Recommendations**
For versions up to, and including 1.7.5, consider disabling the `cli path` parameter until a patch is available to prevent remote code execution. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the `cli path` parameter in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.