WordPress · Pixmagix · CVE-2026-11367
**Name of the Vulnerable Software and Affected Versions**
PixMagix – WordPress Image Editor versions prior to 1.7.3
**Description**
Authenticated attackers with author-level access and above can write files with controlled content to arbitrary server locations. The issue occurs because the `layers[].id` parameter is not sanitized before being concatenated into a filesystem path and passed to the `copy()` function within the `move image on server()` function. This allows the use of traversal sequences to escape the intended upload directory. The attack is possible via the `save template` API endpoint, which is accessible to users with the `create projects` permission.
**Recommendations**
Update PixMagix – WordPress Image Editor to version 1.7.3 or later.
As a temporary mitigation, restrict access to the `save template` API endpoint or limit user permissions to prevent Author-level users from utilizing the `create projects` permission.