What’s Vulnerable › Vulnerabilities

CVE-2024-6486: ImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-05-15 · updated 2026-06-17
• Weakness: CWE-78

Description

The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.

Affected products

• rickardw ImageMagick Engine: before 1.7.11 — fixed in 1.7.11

How to fix

Upgrade to a fixed version: rickardw ImageMagick Engine 1.7.11. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/
• https://wpscan.com/vulnerability/a57c0c59-8b5c-4221-a9db-19f141650d9b/

Get alerted when CVE-2024-6486 or the next vulnerability affects your stack