CVE-2024-6486 ImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection
Administrators can execute arbitrary OS commands via the cli_path parameter in the ImageMagick Engine WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6486?
CVE-2024-6486 is a high-severity command injection vulnerability in Unknown ImageMagick Engine, published on 15 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_path" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code execution.
Weakness: CWE-78
Which versions are affected by CVE-2024-6486?
It affects 1 product.
Products include Orangelab Imagemagick Engine.
How do I fix CVE-2024-6486?
No fix has been published for CVE-2024-6486 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-6486 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-6486 exists.
Other vulnerabilities in Unknown ImageMagick Engine
Sources
Also known as GHSA-j2p9-f4vx-cp2g.