CVE-2026-11367 is a directory traversal vulnerability (CWE-22) in the PixMagix – WordPress Image Editor plugin for WordPress, affecting all versions up to and including 1.7.2. The vulnerability arises from improper sanitization of the 'layers[].id' parameter in the move_image_on_server function, which is concatenated into a filesystem path and passed to PHP's copy() function. This allows authenticated users with author-level access or higher to write attacker-controlled files to arbitrary server locations by leveraging path traversal sequences. The save_template REST endpoint, gated by the create_projects permission (held by authors by default), enables exploitation by any author-level user on affected sites.

An authenticated attacker with author-level privileges can write arbitrary files to any location accessible by the web server process. This could lead to unauthorized file placement, potentially enabling further attacks such as web shell upload or code execution depending on server configuration. The vulnerability does not directly disclose information or cause denial of service but compromises server file integrity and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict author-level permissions where possible and monitor for suspicious activity related to the PixMagix plugin. Consider disabling or removing the plugin if author-level users are not fully trusted. Follow vendor updates closely for an official patch or temporary workaround.