Directory Traversal in PixMagix WordPress Plugin

Executive Summary

The PixMagix WordPress Image Editor plugin is vulnerable to a Directory Traversal attack in all versions up to and including 1.7.2. This vulnerability exists in the move_image_on_server function, where an unsanitized parameter ('layers[].id') is used to build a filesystem path. Because this parameter is not properly sanitized, an attacker with author-level access or higher can include traversal sequences like '../../' to escape the intended upload directory.

This allows the attacker to write files with attacker-controlled content to arbitrary locations on the server by exploiting the PHP copy() function call. The vulnerability is exploitable via the save_template REST endpoint, which requires permissions that author-level users have by default after the plugin is activated.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated attacker with author-level access to write arbitrary files anywhere on the server where the web server process has write permissions. This could lead to unauthorized file creation or modification, potentially enabling further attacks such as web shell uploads, defacement, or other malicious activities.

Since the attacker can place files outside the intended upload directory, this may compromise the integrity and security of the server and the website.

Useful 0 Not Useful 0