CVE-2022-2441

Deeper analysis

The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution through the cli_path parameter in versions up to and including 1.7.5. The flaw stems from insufficient validation and lack of CSRF protection when handling this parameter, which is used to invoke the external ImageMagick binary, allowing arbitrary command execution on the underlying server.

An unauthenticated attacker can exploit the issue by crafting a malicious request and tricking an authenticated administrator into clicking a link or performing another action that triggers the vulnerable code path. Successful exploitation grants the ability to execute arbitrary commands, create or modify files on the server, and establish persistent backdoor access.

Public references point to a WordPress plugin changeset that updated the affected code and to a Wordfence advisory that identifies the vulnerability and recommends updating to a patched release. The Exploit-DB entry and GitHub source links further document the vulnerable code locations around line 529 of imagemagick-engine.php.

EPSS scores for this CVE rose materially from low values after disclosure to a peak of 0.1965 on 2025-01-22 before receding to the current 0.0190, indicating that exploitation interest increased well after the initial publication.